Log in Start free

Vulnerability · Published May 11, 2026 · Assigned by CPANSec

CVE-2026-7010HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values

Medium 6.5

In plain English

A medium-severity security flaw in HTTP::Tiny from HAARG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.2%top 86.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values. The unvalidated inputs are the method and URI in the request line, the URL host that becomes the `Host:` header, and HTTP/1.1 control data field values. An attacker who controls one of these inputs, for example a user supplied URL passed to a webhook or URL fetch endpoint, can inject additional headers and smuggle requests to the upstream server.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.24perl5.42.3-r0ALPINE-CVE-2026-7010
Debian:12libhttp-tiny-perlno fix listedDEBIAN-CVE-2026-7010
Debian:13libhttp-tiny-perl0.090-1+deb13u1DEBIAN-CVE-2026-7010
Debian:14libhttp-tiny-perl0.092-2DEBIAN-CVE-2026-7010
Debian:12perl5.36.0-7+deb12u4DEBIAN-CVE-2026-7010
Debian:13perl5.40.1-6+deb13u1DEBIAN-CVE-2026-7010
Debian:14perl5.40.1-8DEBIAN-CVE-2026-7010
Ubuntu:22.04:LTSlibhttp-tiny-perlno fix listedUBUNTU-CVE-2026-7010
Ubuntu:24.04:LTSlibhttp-tiny-perlno fix listedUBUNTU-CVE-2026-7010
Ubuntu:25.10libhttp-tiny-perlno fix listedUBUNTU-CVE-2026-7010
Ubuntu:26.04:LTSlibhttp-tiny-perlno fix listedUBUNTU-CVE-2026-7010
Ubuntu:26.10libhttp-tiny-perlno fix listedUBUNTU-CVE-2026-7010

Affected products (as reported)

VendorProductVersions
HAARG HTTP::Tiny 0 – before 0.093

Weakness: CWE-113 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References