Vulnerability · Published Jul 28, 2026 · Assigned by VulnCheck

CVE-2026-66753tiny-http 0.12.0 HTTP Response Splitting via Header Injection

Low 3.7

In plain English

A low-severity security flaw in tiny-http from tiny-http. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)3.7Low

Exploit odds (30 days)0.3%top 77.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

tiny-http through 0.12.0 contains an HTTP header injection vulnerability that allows attackers to inject carriage return (0x0D) and line feed (0x0A) bytes into HTTP header values on both request and response sides due to insufficient validation in header parsing and serialization. Attackers can exploit this injection primitive to perform response splitting, cache poisoning, session fixation via Set-Cookie injection, security header override, and request smuggling against line-feed-tolerant backends.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	rust-tiny-http	no fix listed	DEBIAN-CVE-2026-66753
Debian:13	rust-tiny-http	no fix listed	DEBIAN-CVE-2026-66753
Debian:14	rust-tiny-http	no fix listed	DEBIAN-CVE-2026-66753
Ubuntu:24.04:LTS	rust-tiny-http	no fix listed	UBUNTU-CVE-2026-66753
Ubuntu:26.04:LTS	rust-tiny-http	no fix listed	UBUNTU-CVE-2026-66753
Ubuntu:26.10	rust-tiny-http	no fix listed	UBUNTU-CVE-2026-66753

Affected products (as reported)

Vendor	Product	Versions
tiny-http	tiny-http	0 – through 0.12.0

Weakness: CWE-113 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References

Researcher Disclosure technical-description, exploit
https://www.vulncheck.com/advisories/tiny-http-http-response-splitting-via-header-injection third-party-advisory