CVE-2026-27633

TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Versions prior to version 2.02 have a Denial of Service (DoS) vulnerability via memory exhaustion. Unauthenticated remote attackers can send an HTTP POST request to the server with an exceptionally large `Content-Length` header (e.g., `2147483647`). The server continuously allocates memory for the request body (`EntityBody`) while streaming the payload without enforcing any maximum limit, leading to all available memory being consumed and causing the server to crash. Anyone hosting services using TinyWeb is impacted. Version 2.02 fixes the issue. The patch introduces a `CMaxEntityBodySize` limit (set to 10MB) for the maximum size of accepted payloads. As a temporary workaround if upgrading is not immediately possible, consider placing the server behind a Web Application Firewall (WAF) or reverse proxy (like nginx or Cloudflare) configured to explicitly limit the maximum allowed HTTP request body size (e.g., `client_max_body_size` in nginx).

• CWE-400
• CWE-770

• https://github.com/maximmasiutin/TinyWeb/commit/1cb5a1dPatch
• https://github.com/maximmasiutin/TinyWeb/security/advisories/GHSA-992w-gmcm-fmgrVendor Advisory
• https://www.masiutin.net/tinyweb-cve-2026-27633.htmlThird Party Advisory

Published

Feb 26, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27628pypdf is a free and open-source pure-python PDF library. Pri…7.5
• CVE-2026-27629InvenTree is an Open Source Inventory Management System. Pri…8.8
• CVE-2026-2763Use-after-free in the JavaScript Engine component. This vuln…9.8
• CVE-2026-27630TinyWeb is a web server (HTTP, HTTPS) written in Delphi for …7.5
• CVE-2026-27631Exiv2 is a C++ library and a command-line utility to read, w…5.3
• CVE-2026-27632Talishar is a fan-made Flesh and Blood project. Prior to com…3.1
• CVE-2026-27634Piwigo is an open source photo gallery application for the w…9.8
• CVE-2026-27635Manyfold is an open source, self-hosted web application for …8.8
• CVE-2026-27636FreeScout is a free help desk and shared inbox built with PH…8.8
• CVE-2026-27637FreeScout is a free help desk and shared inbox built with PH…9.8
• CVE-2026-27638Actual is a local-first personal finance tool. Prior to vers…7.1
• CVE-2026-27639Mercator is an open source web application designed to enabl…5.4