CVE-2026-7010 HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values
Attackers can inject headers and smuggle requests via unvalidated CRLF in HTTP::Tiny, affecting Perl applications using this library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-7010?
CVE-2026-7010 is a medium-severity vulnerability in HAARG HTTP::Tiny, published on 11 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values.
The unvalidated inputs are the method and URI in the request line, the URL host that becomes the `Host:` header, and HTTP/1.1 control data field values.
An attacker who controls one of these inputs, for example a user supplied URL passed to a webhook or URL fetch endpoint, can inject additional headers and smuggle requests to the upstream server.
Weakness: CWE-113
Which versions are affected by CVE-2026-7010?
Linux distribution packages (1)
perl-HTTP-Tiny openSUSE:Tumbleweed | All versions | 0.094-1.1 |
How do I fix CVE-2026-7010?
Upgrade to a fixed version.
Is CVE-2026-7010 being exploited?
There is no known exploitation of CVE-2026-7010 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-7010, DEBIAN-CVE-2026-7010, ECHO-8f6a-4267-55c4, GHSA-x3qr-8f53-fg74, MGASA-2026-0140, OESA-2026-2371 and 8 more.