HAARG HTTP::Tiny up to 0.092 on Perl HTTP Request Host response splitting

Summaryinfo

A vulnerability classified as critical was found in HAARG HTTP::Tiny up to 0.092 on Perl. The impacted element is an unknown function of the component HTTP Request Handler. Executing a manipulation of the argument Host can lead to response splitting. This vulnerability appears as CVE-2026-7010. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as critical was found in HAARG HTTP::Tiny up to 0.092 on Perl. This vulnerability affects an unknown function of the component HTTP Request Handler. The manipulation of the argument Host with an unknown input leads to a response splitting vulnerability. The CWE definition for the vulnerability is CWE-113. The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values. The unvalidated inputs are the method and URI in the request line, the URL host that becomes the `Host:` header, and HTTP/1.1 control data field values. An attacker who controls one of these inputs, for example a user supplied URL passed to a webhook or URL fetch endpoint, can inject additional headers and smuggle requests to the upstream server.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-7010 since 04/25/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 316761 (openSUSE 16 Security Update : perl-HTTP-Tiny (openSUSE-SU-2026:20792-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 0.093 eliminates this vulnerability. Applying the patch d73c7651e82ace02693842df55928b6c3ae7c38d is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (316761) and EUVD (EUVD-2026-29344). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• HAARG

Name

• HTTP::Tiny

Version

• 0.092

License

• open-source

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion