CVE-2026-28497

Name of the Vulnerable Software and Affected Versions TinyWeb versions prior to 2.03

Description An integer overflow exists in the string-to-integer conversion routine ( Val). This allows a remote, unauthenticated attacker to bypass Content-Length restrictions and perform HTTP Request Smuggling. Successful exploitation can lead to unauthorized access, security filter bypass, and potential cache poisoning. The impact is critical for servers utilizing persistent connections (Keep-Alive).

Recommendations Update to version 2.03 or later.