Skip to content
Fencer Intel
medium 6.5

CVE-2026-7010 json

HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values

published 6mo ago modified yesterday also EUVD-2026-29344

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 14%
public exploits
0
none known

Summary

HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values.

The unvalidated inputs are the method and URI in the request line, the URL host that becomes the `Host:` header, and HTTP/1.1 control data field values.

An attacker who controls one of these inputs, for example a user supplied URL passed to a webhook or URL fetch endpoint, can inject additional headers and smuggle requests to the upstream server.

Patch / fix

  • HAARG HTTP::Tiny 0.093
  • perl Debian 12 5.36.0-7+deb12u4
  • perl Debian 13 5.40.1-6+deb13u1
  • perl Debian 14 5.40.1-8
  • libhttp-tiny-perl Debian 13 0.090-1+deb13u1
  • libhttp-tiny-perl Debian 14 0.092-2

debian advisories DEBIAN-CVE-2026-7010

  • perl-HTTP-Tiny openSUSE Tumbleweed 0.094-1.1

opensuse advisories openSUSE-SU-2026:10805-1

  • perl Alpine 3.24 5.42.3-r0

alpine advisories ALPINE-CVE-2026-7010

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Is CVE-2026-7010 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
5mo ago

Exploit prediction

0.23% chance of exploitation in the next 30 days, higher than 14% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CISA ADP 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected products

  • HAARG HTTP::Tiny
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)

Classification

Weakness
  • CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.