Read the docs
TI-2026-06134 Aliases CVE-2026-7010GHSA-x3qr-8f53-fg74

HTTP response splitting in HAARG HTTP::Tiny

Priority LOW 34CWE-113Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values. The unvalidated inputs are the method and URI in the request line, the URL host that becomes the `Host:` header, and HTTP/1.1 control data field values. An attacker who controls one of these inputs, for example a user supplied URL passed to a webhook or URL fetch endpoint, can inject additional headers and smuggle requests to the upstream server.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00227 13th percentileScored 2026-11-07
Fix Fixed HTTP::Tiny (HAARG): 0.093

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HAARGHTTP::Tinybefore 0.0930.093Patch availableCNA
  • HTTP::Tiny VendorHAARG Affected before 0.093 Fixed in 0.093 Patch available CNA

Remediation

  • Fix · CNA HTTP::Tiny (HAARG) Fixed in 0.093

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-7010
  2. 2026-10-03 Alias added: GHSA-x3qr-8f53-fg74

References

Patch 1

Other 1

  • TI-2026-06141 Insufficiently protected credentials in HAARG HTTP::Tiny CVSS 3.1HIGH 7.1
  • TI-2025-27315 Catalyst::Plugin::Session before version 0.44 for Perl generates session ids insecurely CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences