PT-2026-39866 · Cpan · Tiny-Http

Stig · Published 2026-05-11 · Updated 2026-05-18 · CVE-2026-7010

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions HTTP::Tiny versions prior to 0.093

Description Perl HTTP::Tiny fails to validate CRLF (Carriage Return Line Feed) sequences in HTTP request lines or control field header values. The issue involves unvalidated inputs including the method and URI in the request line, the URL host used for the "Host:" header, and HTTP/1.1 control data field values. An attacker controlling these inputs, such as through a user-supplied URL in a webhook or URL fetch endpoint, can inject additional headers and smuggle requests to the upstream server.

Recommendations Update to version 0.093 or later.

Fix

Weakness Enumeration

CWE-113

Related Identifiers

CVE-2026-7010

OPENSUSE-SU-2026:10805-1

Affected Products

Tiny-Http

References · 16

• https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/d73c7651e82ace02693842df55928b6c3ae7c38d.patch · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-7010 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-7010 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-7010 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-7010 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10805-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-7010 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-7010 · Vendor Advisory
• https://lists.security.metacpan.org/cve-announce/msg/39952806 · Note
• https://t.me/CVEtracker/53425 · Telegram Post
• https://metacpan.org/release/HAARG/HTTP-Tiny-0.093-TRIAL/changes · Note
• https://twitter.com/VulmonFeeds/status/2053992430332993714 · Twitter Post
• http://openwall.com/lists/oss-security/2026/05/11/17 · Note
• https://t.me/cveNotify/163148 · Telegram Post
• https://suse.com/security/cve/CVE-2026-7010 · Note