TinyWeb version 2.03 and earlier contains an integer overflow in the string-to-integer conversion routine (_Val) that allows an unauthenticated attacker to bypass Content-Length restrictions. The flaw enables HTTP Request Smuggling which can be used to gain unauthorized access, bypass security filters, and poison cache entries. The vulnerability is critical for servers that use persistent connections (Keep-Alive).

The issue affects all installations of the TinyWeb web server (HTTP/HTTPS) written in Delphi for Win32, developed by maximmasiutin, specifically any deployment running a version older than 2.03.

The CVSS score of 9.3 indicates a high severity, while the EPSS score of less than 1% reflects a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers would need only network access to a vulnerable server; the exploit is remote and unauthenticated. Until patched, the flaw can be abused to redirect traffic, bypass authentication, or inject malicious content into cached responses.