CVE-2026-7010 Details
Description
HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values. The unvalidated inputs are the method and URI in the request line, the URL host that becomes the `Host:` header, and HTTP/1.1 control data field values. An attacker who controls one of these inputs, for example a user supplied URL passed to a webhook or URL fetch endpoint, can inject additional headers and smuggle requests to the upstream server.
A vulnerability in HTTP::Tiny versions prior to 0.093 for Perl allows for header injection and request smuggling attacks. The issue arises because the library does not properly validate carriage return and line feed (CRLF) characters in HTTP request lines and control field header values. This lack of validation can be exploited by injecting additional headers or manipulating request lines, potentially leading to unauthorized actions on the upstream server.
Users can upgrade to HTTP::Tiny version 0.093 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 11, 2026CISA-ADP
Assessed May 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/d73c7651e82ace02693842df55928b6c3ae7c38d.patch | CPANSec | Source CodeVendor |
| https://metacpan.org/release/HAARG/HTTP-Tiny-0.093-TRIAL/changes | CPANSec | Release NotesVendor |
| http://www.openwall.com/lists/oss-security/2026/05/11/17 | CVE |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-113 | Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| HTTP::Tiny | < 0.093 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CPANSec |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 12, 2026 | CVE Modified | CISA-ADP |
| May 12, 2026 | CVE Modified | CVE |
| May 11, 2026 | New CVE Received | CPANSec |