CVE-2026-28497 is a critical (CVSS 9.1) flaw in TinyWeb, a Delphi web server for Win32, in versions before 2.03. An integer overflow in how it parses numbers lets an unauthenticated attacker bypass Content-Length limits and smuggle HTTP requests. The fix is version 2.03.
What's affected
The GitHub advisory lists the affected package as xBase.pas (Object Pascal), versions before 2.03, with 2.03 as the patched version. The product is TinyWeb, the HTTP and HTTPS server written in Delphi for Win32.
The advisory says the impact is most serious for servers that use persistent connections (Keep-Alive).
How to check if you're exposed
TinyWeb is distributed as source and binaries, not through a package manager, so check the build you deploy. Identify the TinyWeb version in your build or release notes and compare it with 2.03. If you cannot tell, treat the server as affected and rebuild from a 2.03 or later source tree.
Also list any proxy or cache that sits in front of TinyWeb, because smuggling involves disagreement between two parsers.
What to do now
- Update TinyWeb to 2.03 or later and rebuild any binary you ship.
- If you cannot upgrade yet, consider disabling persistent connections on the affected server as a temporary measure, and test that your application still works.
- Check whether a reverse proxy or cache sits in front, and review its settings for strict handling of ambiguous length headers.
- Review access logs for unusual request patterns around the time you were exposed.
Why it matters
The record lists two weaknesses. CWE-190 is the integer overflow in the string-to-integer routine. CWE-444 is inconsistent interpretation of HTTP requests, which is what smuggling is.
When a server miscounts the body length of a request, bytes meant for one request can be read as the start of the next. On a connection that is reused, that can slip a second request past security filters or poison a cache. The advisory names unauthorized access, filter bypass and cache poisoning as potential effects. It is not listed as exploited in the wild in the record.
Quick check
Why does Keep-Alive matter here?
Smuggling needs a connection that carries more than one request. With persistent connections the bytes after a miscounted body are read as the next request, which is why the advisory calls the impact critical for those servers.
Sources
Last reviewed: 19 October 2026.
