CVE-2026-7010
MediumSummary
HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values. The unvalidated inputs include the method and URI in the request line and the URL host that becomes the `Host:` header.
Risk Assessment
An attacker may exploit this vulnerability to inject malicious data into HTTP headers, potentially leading to HTTP response splitting attacks or other forms of request manipulation.
Recommendation
It is recommended to upgrade to HTTP::Tiny version 0.093 or later to ensure proper validation of input data in HTTP requests.
Original NVD description (English source)
HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values. The unvalidated inputs are the method and URI in the request line, the URL host that becomes the `Host:` header, and HTTP/1.1 control data field values. An attacker who controls one