[<prev] [next>] [day] [month] [year] [list]
Message-Id: <37024799-4603-4042-9296-3DAD7442C146@stig.io>
Date: Mon, 11 May 2026 23:18:22 +0200
From: Stig Palmquist <stig@...g.io>
To: cve-announce@...urity.metacpan.org,
oss-security@...ts.openwall.com
Subject: CVE-2026-7010: HTTP::Tiny versions before 0.093 for Perl do not
validate CRLF in HTTP request lines or control field header values
========================================================================
CVE-2026-7010 CPAN Security Group
========================================================================
CVE ID: CVE-2026-7010
Distribution: HTTP-Tiny
Versions: before 0.093
MetaCPAN: https://metacpan.org/dist/HTTP-Tiny
VCS Repo: https://github.com/Perl-Toolchain-Gang/HTTP-Tiny
HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP
request lines or control field header values
Description
-----------
HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP
request lines or control field header values.
The unvalidated inputs are the method and URI in the request line, the
URL host that becomes the `Host:` header, and HTTP/1.1 control data
field values.
An attacker who controls one of these inputs, for example a user
supplied URL passed to a webhook or URL fetch endpoint, can inject
additional headers and smuggle requests to the upstream server.
Problem types
-------------
- CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers
('HTTP Request/Response Splitting')
Solutions
---------
Upgrade to HTTP-Tiny 0.093-TRIAL or later.
References
----------
https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/d73c7651e82ace02693842df55928b6c3ae7c38d.patch
https://metacpan.org/release/HAARG/HTTP-Tiny-0.093-TRIAL/changes
Timeline
--------
- 2026-04-25: Issue discovered.
- 2026-05-11: HTTP-Tiny 0.093-TRIAL published with fix.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
