CVE-2026-7010
MEDIUM EPSS 13.3%
Published May 11, 20261mo ago · Modified Jun 17, 20262w ago
6.5 CVSS 3.1
Published May 11, 2026 1mo ago
Last Modified Jun 17, 2026 2w ago
Description
HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values. The unvalidated inputs are the method and URI in the request line, the URL host that becomes the `Host:` header, and HTTP/1.1 control data field values. An attacker who controls one of these inputs, for example a user supplied URL passed to a webhook or URL fetch endpoint, can inject additional headers and smuggle requests to the upstream server.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity Low
Availability None
Threat Intelligence
EPSS Exploit Probability
13.3% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-113
References 3
- openwall.com http://www.openwall.com/lists/oss-security/2026/05/11/17
- github.com https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/d73c7651e82ace02693842df55928b6c3ae7c38d.patch
- metacpan.org https://metacpan.org/release/HAARG/HTTP-Tiny-0.093-TRIAL/changes
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.