← Vulnerability feed

Vulnerability record · CVE-2024-5193 · published 22 May 2024

CVE-2024-5193: Ritlabs tinyweb injection vulnerability

Ritlabs · Tinyweb

A security vulnerability has been detected in Ritlabs TinyWeb Server 1.94. This vulnerability affects unknown code of the component Request Handler. The manipulation with the input %0D%0A leads to crlf injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.99 is able to resolve this issue. The identifier of the patch is d49c3da6a97e950975b18626878f3ee1f082358e. It is suggested to upgrade the affected component. The vendor was contacted early about this disclosure but did not respond in any way.

5.5 CVSS 4.0 Medium EPSS 0.66% · top 50.3% CWE-74 · InjectionCWE-93 · CWE-93
5.5CVSS 4.0 base score, v2 5.0
0.66%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
11References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

A security vulnerability has been detected in Ritlabs TinyWeb Server 1.94. This vulnerability affects unknown code of the component Request Handler. The manipulation with the input %0D%0A leads to crlf injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.99 is able to resolve this issue. The identifier of the patch is d49c3da6a97e950975b18626878f3ee1f082358e. It is suggested to upgrade the affected component. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/DMCERTCE/CRLF_Tiny Exploit
https://github.com/maximmasiutin/TinyWeb/commit/d49c3da6a97e950975b18626878f3ee1f082358e
https://github.com/maximmasiutin/TinyWeb/releases/tag/v1.99
https://vuldb.com/?ctiid.265830 Permissions RequiredVDB Entry
https://vuldb.com/?id.265830 Third Party AdvisoryVDB Entry
https://vuldb.com/?submit.333059 Third Party AdvisoryVDB Entry
https://www.masiutin.net/tinyweb-cve-2024-5193.html
https://github.com/DMCERTCE/CRLF_Tiny Exploit
https://vuldb.com/?ctiid.265830 Permissions RequiredVDB Entry
https://vuldb.com/?id.265830 Third Party AdvisoryVDB Entry
https://vuldb.com/?submit.333059 Third Party AdvisoryVDB Entry

Track CVE-2024-5193 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2026-27613Ritlabs tinyweb os command injection vulnerabilityTinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. A vulnerability in versions prior to 2.01 allows unauthenticated remote attackers …EPSS 1.4%10.0CVE-2026-22781Ritlabs tinyweb os command injection vulnerabilityTinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. TinyWeb HTTP Server before version 1.98 is vulnerable to OS command injection via …EPSS 2.5%9.3CVE-2026-28497Ritlabs tinyweb integer overflow vulnerabilityTinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Prior to version 2.03, an integer overflow vulnerability in the string-to-integer …EPSS 0.67%9.2CVE-2026-29046Ritlabs tinyweb improper input validation vulnerabilityTinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Prior to version 2.04, TinyWeb accepts request header values and later maps them i…EPSS 0.56%8.7CVE-2026-27633Ritlabs tinyweb uncontrolled resource consumption vulnerabilityTinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Versions prior to version 2.02 have a Denial of Service (DoS) vulnerability via me…EPSS 0.82%8.7CVE-2026-27630Ritlabs tinyweb uncontrolled resource consumption vulnerabilityTinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Versions prior to version 2.02 are vulnerable to a Denial of Service (DoS) attack …EPSS 0.82%8.6CVE-2024-34199Ritlabs tinyweb out-of-bounds write vulnerabilityTinyWeb 1.94 and below allows unauthenticated remote attackers to cause a denial of service (Buffer Overflow) when sending excessively large elements…EPSS 1.2%10.0CVE-2025-20337Cisco ISE API input validation flaw allows unauthenticated root RCECisco ISE and ISE-PIC fail to properly validate user-supplied input in a specific API, letting an unauthenticated remote attacker execute arbitrary c…KEVEPSS 68%analysed

Source: NIST National Vulnerability Database (record CVE-2024-5193), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.