TinyWeb is a Win32 HTTP/HTTPS web server written in Delphi. Prior to version 2.02 it spawns a new OS thread for each incoming connection without imposing a maximum thread limit or an adequate request idle‑timeout. An unauthenticated remote attacker can open many connections and send data very slowly—e.g., one byte every few minutes—in order to exhaust the process’s thread pool and memory, causing a denial of service. The flaw is a resource exhaustion vulnerability (CWE‑400) combined with an uncontrolled creation of worker threads (CWE‑770).

The vulnerability affects the TinyWeb web server distributed by maximmasiutin (also listed as ritlabs:tinyweb). Versions older than 2.02 are impacted. Any deployment of TinyWeb serving websites or other HTTP services on Windows is vulnerable if it has not been updated to 2.02 or later.

The CVSS base score is 8.7, indicating high severity. The EPSS score is below 1 %, suggesting a low but non‑zero probability of exploitation at present; the vulnerability is not currently listed in the CISA KEV catalog. Attackers need only open multiple slow connections without authentication, making the exploit trivial to automate. If successful, the attack will consume operating system threads and memory until the server becomes unresponsive, leading to service interruption for all legitimate users.