A vulnerability was found in the Request Handler component of Ritlabs TinyWeb Server. The manipulation with the input `%0D%0A` leads to CRLF injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.