What is CVE-2026-28497?

CVE-2026-28497 is a critical-severity vulnerability in Maximmasiutin Tinyweb, classified under Integer Overflow or Wraparound. CVSS score: 9.1/10. Published 2026-03-06.

How severe is CVE-2026-28497?

Critical severity. CVSS v3 base score is 9.1 out of 10.

Integer overflow in Maximmasiutin Tinyweb

CVE-2026-28497

TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Prior to version 2.03, an integer overflow vulnerability in the string-to-integer conversion routine (_Val) allows an unauthenticated remote attacker to bypass Content-Length restrictions and perform HTTP Request Smuggling. This can lead to unauthorized access, security filter bypass, and potential cache poisoning. The impact is critical for servers using persistent connections (Keep-Alive). This issue has been patched in version 2.03.

Vulnerability class: Integer Overflow

Published 2026-03-06 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H.

EPSS exploit prediction

EPSS: 0.007 (52.9th percentile), scored 2026-10-24.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 53rd percentile — 52.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.007 · newest: 0.007 · change: +0.000

Affected products

Maximmasiutin Tinyweb — versions < 2.03
Ritlabs Tinyweb

Weakness classification (CWE)

References

github.com/maximmasiutin/TinyWeb/security/advisories/GHSA-rp8j-cx7r-mw9f (Exploit, Vendor Advisory)
github.com/maximmasiutin/TinyWeb/commit/d2edd0322c3d74beee0a6c0191299b8946695d4e (Patch)

Frequently asked questions

What is CVE-2026-28497?: CVE-2026-28497 is a critical-severity vulnerability in Maximmasiutin Tinyweb, classified under Integer Overflow or Wraparound. CVSS score: 9.1/10. Published 2026-03-06.
How severe is CVE-2026-28497?: Critical severity. CVSS v3 base score is 9.1 out of 10.