CVE catalog

CVE-2026-7010

HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values. The unvalidated inputs are the method and URI in the request line, the URL host th

[CVE catalog]

Severity: Medium · CVSS 6.5
Published: May 11, 2026, 10:22:14 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.36% · Oct 23, 2026

HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values. The unvalidated inputs are the method and URI in the request line, the URL host that becomes the `Host:` header, and HTTP/1.1 control data field values. An attacker who controls one of these inputs, for example a user supplied URL passed to a webhook or URL fetch endpoint, can inject additional headers and smuggle requests to the upstream server.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	perl	sid	`5.42.3-1`	fixed
Debian	perl	forky	`5.42.3-1`	fixed
Debian	perl	trixie	`5.40.1-6+deb13u1`	fixed
Debian	perl	bookworm	`5.36.0-7+deb12u3`	vulnerable
Debian	perl	bookworm-security	`5.36.0-7+deb12u4`	fixed
Debian	libhttp-tiny-perl	sid	`0.096-1`	fixed
Debian	libhttp-tiny-perl	forky	`0.096-1`	fixed
Debian	libhttp-tiny-perl	trixie	`0.090-1+deb13u1`	fixed
Debian	libhttp-tiny-perl	bookworm	`0.082-2`	vulnerable
Cpe	libhttp-tiny-perl	Not reported	Not reported	vulnerable
Cpe	perl	Not reported	Not reported	vulnerable
Opensuse	perl-HTTP-Tiny	tumbleweed	`0.094-1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	perl	source	sid	`5.40.1-8`	not yet assigned	Not reported	[1138858]
Debian	perl	source	forky	`5.40.1-8`	not yet assigned	Not reported	[1138858]
Debian	perl	source	trixie	`5.40.1-6+deb13u1`	not yet assigned	Not reported	[1138858]
Debian	perl	source	bookworm	`5.36.0-7+deb12u4`	not yet assigned	Not reported	[1138858]
Debian	libhttp-tiny-perl	source	sid	`0.092-2`	not yet assigned	Not reported	[1146064]
Debian	libhttp-tiny-perl	source	forky	`0.092-2`	not yet assigned	Not reported	[1146064]
Debian	libhttp-tiny-perl	source	trixie	`0.090-1+deb13u1`	not yet assigned	Not reported	[1146064]
Debian	libhttp-tiny-perl	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1146064]
Opensuse	perl-HTTP-Tiny	rpm	tumbleweed	`0.094-1.1`	Not reported	OPENSUSE-SU-2026:10805-1	Not reported

[Debian bug #1138858][Debian bug #1146064]

Notes

[bookworm] libhttp-tiny-perl: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libhttp-tiny-perl]Affected
Details (2)
- 0.082-2 · all · bookworm
  Affected
  nvd · libhttp-tiny-perl · debian · bookworm; nvd · libhttp-tiny-perl · debian · 12
- 0.082-2 · all · bookworm
  Affected
  nvd · libhttp-tiny-perl · debian · bookworm; nvd · libhttp-tiny-perl · debian · 12
[libperl5.36]Affected
Source package: [perl]
Details (4)
- 5.36.0-7+deb12u3 · amd64 · bookworm
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u3 · arm64 · bookworm
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u2 · amd64 · bookworm-security
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u2 · arm64 · bookworm-security
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
[libperl-dev]Affected
Source package: [perl]
Details (4)
- 5.36.0-7+deb12u3 · amd64 · bookworm
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u3 · arm64 · bookworm
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u2 · amd64 · bookworm-security
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u2 · arm64 · bookworm-security
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
[perl]Affected
Details (4)
- 5.36.0-7+deb12u3 · amd64 · bookworm
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u3 · arm64 · bookworm
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u2 · amd64 · bookworm-security
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u2 · arm64 · bookworm-security
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
[perl-base]Affected
Source package: [perl]
Details (4)
- 5.36.0-7+deb12u3 · amd64 · bookworm
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u3 · arm64 · bookworm
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u2 · amd64 · bookworm-security
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u2 · arm64 · bookworm-security
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
[perl-debug]Affected
Source package: [perl]
Details (4)
- 5.36.0-7+deb12u3 · amd64 · bookworm
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u3 · arm64 · bookworm
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u2 · amd64 · bookworm-security
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u2 · arm64 · bookworm-security
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
[perl-doc]Affected
Source package: [perl]
Details (4)
- 5.36.0-7+deb12u3 · all · bookworm
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u3 · all · bookworm
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u2 · all · bookworm-security
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u2 · all · bookworm-security
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
[perl-modules-5.36]Affected
Source package: [perl]
Details (4)
- 5.36.0-7+deb12u3 · all · bookworm
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u3 · all · bookworm
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u2 · all · bookworm-security
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u2 · all · bookworm-security
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12

[Debian 13 (Trixie)]

[libhttp-tiny-perl]Affected
Details (2)
- 0.090-1 · all · trixie
  Affected · Fixed: 0.090-1+deb13u1
  nvd · libhttp-tiny-perl · debian · 13
- 0.090-1 · all · trixie
  Affected · Fixed: 0.090-1+deb13u1
  nvd · libhttp-tiny-perl · debian · 13
[libperl5.40]Affected
Source package: [perl]
Details (2)
- 5.40.1-6 · amd64 · trixie
  Affected · Fixed: 5.40.1-6+deb13u1
  nvd · perl · debian · 13
- 5.40.1-6 · arm64 · trixie
  Affected · Fixed: 5.40.1-6+deb13u1
  nvd · perl · debian · 13
[libperl-dev]Affected
Source package: [perl]
Details (2)
- 5.40.1-6 · amd64 · trixie
  Affected · Fixed: 5.40.1-6+deb13u1
  nvd · perl · debian · 13
- 5.40.1-6 · arm64 · trixie
  Affected · Fixed: 5.40.1-6+deb13u1
  nvd · perl · debian · 13
[perl]Affected
Details (2)
- 5.40.1-6 · amd64 · trixie
  Affected · Fixed: 5.40.1-6+deb13u1
  nvd · perl · debian · 13
- 5.40.1-6 · arm64 · trixie
  Affected · Fixed: 5.40.1-6+deb13u1
  nvd · perl · debian · 13
[perl-base]Affected
Source package: [perl]
Details (2)
- 5.40.1-6 · amd64 · trixie
  Affected · Fixed: 5.40.1-6+deb13u1
  nvd · perl · debian · 13
- 5.40.1-6 · arm64 · trixie
  Affected · Fixed: 5.40.1-6+deb13u1
  nvd · perl · debian · 13
[perl-debug]Affected
Source package: [perl]
Details (2)
- 5.40.1-6 · amd64 · trixie
  Affected · Fixed: 5.40.1-6+deb13u1
  nvd · perl · debian · 13
- 5.40.1-6 · arm64 · trixie
  Affected · Fixed: 5.40.1-6+deb13u1
  nvd · perl · debian · 13
[perl-doc]Affected
Source package: [perl]
Details (2)
- 5.40.1-6 · all · trixie
  Affected · Fixed: 5.40.1-6+deb13u1
  nvd · perl · debian · 13
- 5.40.1-6 · all · trixie
  Affected · Fixed: 5.40.1-6+deb13u1
  nvd · perl · debian · 13
[perl-modules-5.40]Affected
Source package: [perl]
Details (2)
- 5.40.1-6 · all · trixie
  Affected · Fixed: 5.40.1-6+deb13u1
  nvd · perl · debian · 13
- 5.40.1-6 · all · trixie
  Affected · Fixed: 5.40.1-6+deb13u1
  nvd · perl · debian · 13

[openSUSE Tumbleweed]

[perl-HTTP-Tiny]Fixed
Source package: [perl-HTTP-Tiny]
Details (1)
- 0.096-2.2 · noarch · tumbleweed
  Fixed · Fixed: 0.094-1.1
  nvd · perl-HTTP-Tiny · opensuse · tumbleweed

Observed: Oct 23, 2026, 10:03:48 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]