CVE-2026-7010
Severity CVSS v4.0:
Pending analysis
Type:
CWE-113
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')
Publication date:
11/05/2026
Last modified:
12/05/2026
Description
HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values.<br />
<br />
The unvalidated inputs are the method and URI in the request line, the URL host that becomes the `Host:` header, and HTTP/1.1 control data field values.<br />
<br />
An attacker who controls one of these inputs, for example a user supplied URL passed to a webhook or URL fetch endpoint, can inject additional headers and smuggle requests to the upstream server.
Impact
Base Score 3.x
6.50
Severity 3.x
MEDIUM