CVE-2026-7010

MediumCVSS 6.5

Published: 11/05/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

13th percentile - higher than 13% of all known CVEs

Summary

HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values. The unvalidated inputs are the method and URI in the request line, the URL host that becomes the Host: header, and HTTP/1.1 control data field values. An attacker who controls one of these inputs, for example a user-supplied URL passed to a webhook or URL fetch endpoint, can inject additional headers and smuggle requests to the upstream server.

Risk Assessment

The vulnerability enables header injection and request smuggling, which can lead to bypassing security controls, cache poisoning, or unauthorized access to internal resources. It is especially relevant for applications that accept user-supplied URLs and perform outbound requests.

Recommendation

Update HTTP::Tiny to version 0.093 or later. Additionally, validate and sanitize all user-supplied input used to construct HTTP requests.

Other vulnerabilities in HTTP::Tiny

CVE-2026-7017High
Vulnerability in HTTP::Tiny for Perl before version 0.095 causes credential headers (Authorization, Cookie, Proxy-Authorization) to be forwarded to cross-origin redirect targets. The redirect mechanism does not verify whether the redirect target shares an origin with the original URL, allowing sensitive data leakage.

Original NVD description (English source)

HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values. The unvalidated inputs are the method and URI in the request line, the URL host that becomes the `Host:` header, and HTTP/1.1 control data field values. An attacker who controls one of these inputs, for example a user supplied URL passed to a webhook or URL fetch endpoint, can inject additional headers and smuggle requests to the upstream server.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS