TinyWeb 1.9 allows remote attackers to cause a denial of service (CPU consumption) via a ".%00." in an HTTP GET request to the cgi-bin directory.
https://exchange.xforce.ibmcloud.com/vulnerabilities/13402
https://euvd.enisa.europa.eu/vulnerability/EUVD-2003-1500