CVE-2026-7010

CVE Enrichment

CVSS: 6.5 MEDIUM
EPSS: 0.36%
EPSS Percentile: 28.37%
CISA KEV: Not listed

Description

HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values. The unvalidated inputs are the method and URI in the request line, the URL host that becomes the `Host:` header, and HTTP/1.1 control data field values. An attacker who controls one of these inputs, for example a user supplied URL passed to a webhook or URL fetch endpoint, can inject additional headers and smuggle requests to the upstream server.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e
Published: 12-May-2026 05:22
Last Modified: 17-Jun-2026 18:01
EPSS Date: 2026-10-20
CWE: CWE-113

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:L /
                            I:L /
                            A:N

References

Last enrichment sync: 01-Nov-2026 20:10
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

Both packages also fix CRLF validation, CVE-2026-7010. Debian 13.7 Bundles 92 Security Advisories and Updates 106 Packages

CVE (19)

Products (18)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.