Executive brief
Ritlabs TinyWeb Server, a lightweight web server for Windows, contains a security vulnerability in how it handles user authentication. By sending a specially crafted Authorization header, a remote attacker can cause the server to crash or potentially execute unauthorized code. This could lead to a complete takeover of the server or a disruption of hosted web services.
Technical details
A stack-based buffer overflow exists in Ritlabs TinyWeb Server (up to version 1.94) within the Header Handler component. The vulnerability is triggered by providing an overly long string in the 'Authorization' HTTP header. While the input is Base64 encoded, the application fails to properly validate the length of the decoded data before copying it to a fixed-size stack buffer (max ~692 bytes). An attacker can exploit this via a remote, unauthenticated network request. Although the exploit is constrained by a maximum byte value of 0x3F due to the encoding scheme, researchers have demonstrated a functional ROP chain and egghunter technique to bypass these limitations on Windows 32-bit systems. No patch is currently available as the vendor did not respond to disclosure attempts.
Affected products
- Ritlabs TinyWeb Server up to 1.94
Timeline
- 2026-03-14: disclosed: Initial researcher write-up and exploit disclosure
- 2026-06-15: advisory: CVE published to NVD