vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2024-5193

Ritlabs TinyWeb Server Request crlf injection

MEDIUM
5.3
CVSS Score
Published: May 22, 2024 at 10:31 AM UTC
Updated: June 17, 2026 at 08:15 AM UTC
1 product affected across 1 vendorTinyweb

Using TinyWeb Server by Ritlabs?

Get instant alerts when new vulnerabilities affect TinyWeb Server - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM5.3
Exploit prediction
EPSS 0.7%
SSVC
PoC

Description

A vulnerability was found in Ritlabs TinyWeb Server 1.94. It has been classified as problematic. Affected is an unknown function of the component Request Handler. The manipulation with the input %0D%0A leads to crlf injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-265830 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Tinyweb· Ritlabs
95%
1.94
Vendor states this is fixed in 1.99 (unaffected)

References (7)

Exploit
Source: [email protected]
https://github.com/DMCERTCE/CRLF_Tiny
SignaturePermissions RequiredVDB Entry
Source: [email protected]
https://vuldb.com/?ctiid.265830
VDB EntryTechnical DescriptionMitigationPatchThird Party Advisory
Source: [email protected]
https://vuldb.com/?id.265830
Third Party AdvisoryVDB Entry
Source: [email protected]
https://vuldb.com/?submit.333059
Patch
Source: cverecord
https://github.com/maximmasiutin/TinyWeb/commit/d49c3da6a97e950975b18626878f3ee1f082358e
Patch
Source: cverecord
https://github.com/maximmasiutin/TinyWeb/releases/tag/v1.99
Mitigation
Source: cverecord
https://www.masiutin.net/tinyweb-cve-2024-5193.html

SSVC — Action Prioritization

SSVCPoCAutomatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

5.3MEDIUMVulDB
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-93CWE-74

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card