CVE-2026-66753: tiny-http XSS Vulnerability

CVE-2026-66753 Overview

CVE-2026-66753 is an HTTP header injection vulnerability in the tiny-http Rust crate through version 0.12.0. The library fails to validate carriage return (0x0D) and line feed (0x0A) bytes in HTTP header values during parsing and serialization. This affects both the request and response sides of the HTTP pipeline. Attackers can inject CRLF sequences to perform response splitting, cache poisoning, session fixation through Set-Cookie injection, security header override, and request smuggling against line-feed-tolerant backends. The flaw is categorized under CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers.

Critical Impact
Unauthenticated network-based attackers can inject arbitrary HTTP headers, enabling response splitting, cache poisoning, and downstream request smuggling.

Affected Products

tiny-http Rust crate versions through 0.12.0
Applications embedding tiny-http as an HTTP server library
Downstream services and caches proxied by tiny-http-based servers

Discovery Timeline

2026-07-28 - CVE-2026-66753 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-66753

Vulnerability Analysis

The tiny-http crate does not neutralize CR (\r) and LF (\n) bytes when handling HTTP header values. Header parsing accepts these bytes on inbound requests, and header serialization emits them verbatim on outbound responses. Because HTTP semantics rely on CRLF as a structural delimiter between headers and between headers and the message body, permitting raw CR/LF inside a header value collapses the boundary between data and protocol structure.

An attacker who controls any portion of a header value, such as a reflected parameter written into Location, Set-Cookie, or a custom header, can terminate the current header line and inject additional headers or an entire response body. On the inbound path, the same primitive lets a client smuggle headers past middleboxes that treat only strict CRLF as a delimiter while tiny-http accepts bare LF.

Root Cause

The root cause is insufficient input validation in the header parsing and serialization routines. HTTP RFC 9110 requires servers to reject or sanitize CR and LF within field values, but tiny-http performs no such check. Any byte string is accepted and forwarded, which violates the boundary between header data and header framing.

Attack Vector

Exploitation is remote and unauthenticated. An attacker submits a request whose reflected user input contains encoded CRLF sequences, or supplies a header field containing bare LF bytes. When the application constructs a response header from that input, the injected bytes split the response. Downstream caches may store the split response as a legitimate object, and shared proxies may associate the smuggled response with an unrelated victim connection.

The practical outcomes include:

Setting attacker-controlled Set-Cookie values for session fixation.
Overwriting security headers such as Content-Security-Policy or Strict-Transport-Security.
Poisoning shared HTTP caches with attacker-controlled bodies.
Smuggling requests to backends that accept bare LF as a line terminator.

A public proof-of-concept demonstrates the injection primitive against a tiny-http server. See the GitHub PoC repository and the VulnCheck Security Advisory for technical details. No synthetic exploitation code is reproduced here.

Detection Methods for CVE-2026-66753

Indicators of Compromise

HTTP request or response headers containing raw 0x0D or 0x0A bytes inside field values.
Unexpected duplicate response headers, particularly Set-Cookie, Location, or Content-Type, originating from the same upstream.
Cache entries whose bodies do not match the requested resource path or content type.
Anomalous response bodies delivered under headers that indicate a redirect or empty payload.

Detection Strategies

Inspect ingress traffic for URL-encoded CRLF sequences (%0d, %0a, %0d%0a) in query strings, path segments, and headers that the application reflects.
Log full request and response headers at the reverse proxy and correlate on unexpected header repetition or unusual header ordering.
Fuzz endpoints that echo user input into response headers with CR/LF payloads and compare emitted responses against a strict grammar.

Monitoring Recommendations

Alert on requests where header values contain non-printable control bytes outside 0x20-0x7E plus \t.
Track cache hit ratios and content-length variance per URL to detect cache poisoning.
Correlate Set-Cookie emissions per session identifier to identify overwrite attempts consistent with fixation.

How to Mitigate CVE-2026-66753

Immediate Actions Required

Inventory all Rust services that depend on tiny-http, including transitive dependencies, using cargo tree.
Sanitize any application code paths that place untrusted input into HTTP response headers by stripping or rejecting CR and LF bytes.
Place a hardened reverse proxy in front of tiny-http servers to normalize headers and reject bare LF line terminators.
Disable shared caching for endpoints that reflect user input into headers until a patched release is deployed.

Patch Information

At the time of NVD publication no fixed release was listed. Monitor the VulnCheck Security Advisory and the upstream tiny-http repository for a release beyond 0.12.0 that validates CR and LF in header values. Rebuild and redeploy all dependent services once a patched crate version is available.

Workarounds

Wrap header-setting APIs in a helper that rejects any value containing \r or \n before it is passed to tiny-http.
Enforce strict allow-lists on header values that incorporate request-derived data such as redirect targets and cookie contents.
Terminate TLS and HTTP parsing at a front-end proxy such as Nginx or Envoy that rejects malformed headers before they reach tiny-http.

bash

# Configuration example: reject requests containing CR or LF in query strings at Nginx
if ($args ~* "(%0d|%0a|\r|\n)") {
    return 400;
}