CVE-2026-27630

TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Versions prior to version 2.02 are vulnerable to a Denial of Service (DoS) attack known as Slowloris. The server spawns a new OS thread for every incoming connection without enforcing a maximum concurrency limit or an appropriate request timeout. An unauthenticated remote attacker can exhaust server concurrency limits and memory by opening numerous connections and sending data exceptionally slowly (e.g. 1 byte every few minutes). Anyone hosting services using TinyWeb is impacted. Version 2.02 fixes the issue. The patch introduces a `CMaxConnections` limit (set to 512) and a `CConnectionTimeoutSecs` idle timeout (set to 30 seconds). As a temporary workaround if upgrading is not immediately possible, consider placing the server behind a robust reverse proxy or Web Application Firewall (WAF) such as nginx, HAProxy, or Cloudflare, configured to buffer incomplete requests and aggressively enforce connection limits and timeouts.

• CWE-400
• CWE-770

• https://github.com/maximmasiutin/TinyWeb/commit/23268c8Patch
• https://github.com/maximmasiutin/TinyWeb/security/advisories/GHSA-ccv5-8948-c99cVendor Advisory
• https://www.masiutin.net/tinyweb-cve-2026-27630.htmlThird Party Advisory

Published

Feb 26, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27625Stirling-PDF is a locally hosted web application that perfor…6.5
• CVE-2026-27626OliveTin gives access to predefined shell commands from a we…9.9
• CVE-2026-27627Karakeep is a elf-hostable bookmark-everything app. In versi…6.1
• CVE-2026-27628pypdf is a free and open-source pure-python PDF library. Pri…7.5
• CVE-2026-27629InvenTree is an Open Source Inventory Management System. Pri…8.8
• CVE-2026-2763Use-after-free in the JavaScript Engine component. This vuln…9.8
• CVE-2026-27631Exiv2 is a C++ library and a command-line utility to read, w…5.3
• CVE-2026-27632Talishar is a fan-made Flesh and Blood project. Prior to com…3.1
• CVE-2026-27633TinyWeb is a web server (HTTP, HTTPS) written in Delphi for …7.5
• CVE-2026-27634Piwigo is an open source photo gallery application for the w…9.8
• CVE-2026-27635Manyfold is an open source, self-hosted web application for …8.8
• CVE-2026-27636FreeScout is a free help desk and shared inbox built with PH…8.8