CVE-2026-7010: HTTP::Tiny for Perl CRLF Injection Vulnerability

CVE-2026-7010 Overview

CVE-2026-7010 affects HTTP::Tiny versions before 0.093 for Perl. The library fails to validate carriage return and line feed (CRLF) sequences in HTTP request lines and control field header values. Unvalidated inputs include the request method, URI, the URL host that becomes the Host: header, and HTTP/1.1 control data field values. An attacker who controls one of these inputs, such as a user-supplied URL passed to a webhook or URL fetch endpoint, can inject additional headers and smuggle requests to the upstream server. The vulnerability is classified under [CWE-113] (Improper Neutralization of CRLF Sequences in HTTP Headers).

Critical Impact
Attackers can inject arbitrary HTTP headers and smuggle requests through applications that pass untrusted input to HTTP::Tiny, leading to cache poisoning, SSRF amplification, and authentication bypass against upstream services.

Affected Products

HTTP::Tiny for Perl versions before 0.093
Perl applications using HTTP::Tiny as a transitive dependency for HTTP client functionality
Webhook handlers and URL fetch endpoints built on HTTP::Tiny

Discovery Timeline

2026-05-11 - CVE-2026-7010 published to NVD and disclosed on the OpenWall OSS Security list
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-7010

Vulnerability Analysis

HTTP::Tiny constructs HTTP/1.1 request messages by concatenating caller-supplied strings into the request line and header block. The library does not reject CRLF sequences (\\x0D\\x0A) embedded in the method, URI, host, or header values. Because HTTP/1.1 uses CRLF as the message framing delimiter, an embedded CRLF terminates the current header and begins a new one.

When a Perl application forwards user input to HTTP::Tiny, an attacker can append \r\n followed by attacker-chosen headers or an entire second request. The receiving server parses this injected content as legitimate protocol data. This enables header injection, HTTP response splitting on intermediate proxies, and request smuggling against the upstream origin.

Root Cause

The root cause is missing input validation on protocol-significant control characters before request serialization. The patched version adds a regex check against the Field_Content production from RFC 7230 and dies on any header value containing characters outside the allowed set.

Attack Vector

Exploitation requires network access and no privileges or user interaction. A typical attack target is a Perl service that fetches a URL supplied by a remote user, such as a webhook validator, link previewer, or SSRF-style fetch endpoint. The attacker submits a URL whose host component, path, or associated headers contain CRLF sequences. HTTP::Tiny serializes those sequences verbatim, smuggling an additional request to the upstream server.

text

         my $field_name = $HeaderCase{$k};
         my $v = $headers->{$k};
         for (ref $v eq 'ARRAY' ? @$v : $v) {
+            die(qq/Invalid HTTP header field value ($field_name): / . $Printable->($_). "\n")
+              unless $_ eq '' || /\A $Field_Content \z/xo;
             $_ = '' unless defined $_;
             $buf .= "$field_name: $_\\x0D\\x0A";
         }

Source: GitHub Commit Patch — the patch rejects header values that do not match the RFC 7230 Field_Content grammar before they are appended to the outbound request buffer.

Detection Methods for CVE-2026-7010

Indicators of Compromise

Outbound HTTP requests from Perl application hosts containing unexpected Host:, Transfer-Encoding:, or Content-Length: headers not generated by the application
Web server access logs showing two request lines arriving in a single TCP segment from an internal client
User-supplied URL parameters containing literal %0d%0a, \r\n, or raw 0x0D 0x0A byte sequences in host or path components

Detection Strategies

Inventory Perl applications and inspect cpanfile, Makefile.PL, and installed module metadata for HTTP::Tiny versions below 0.093
Inspect application code for caller-controlled values passed to HTTP::Tiny->request, get, post, or mirror without prior CRLF stripping
Deploy egress proxy rules that reject outbound requests containing malformed framing or duplicate Host headers

Monitoring Recommendations

Log full outbound HTTP request lines and headers from Perl service hosts and alert on CRLF byte sequences inside URI or header values
Correlate webhook fetch events with upstream request anomalies such as response splitting markers or unexpected method verbs
Monitor for elevated 400-class responses from upstream services that may indicate framing manipulation attempts

How to Mitigate CVE-2026-7010

Immediate Actions Required

Upgrade HTTP::Tiny to version 0.093 or later across all Perl runtime environments
Audit application code that forwards user-controlled URLs or header values to HTTP::Tiny and add explicit CRLF rejection at the input boundary
Restrict webhook and URL-fetch endpoints to allow-listed hosts and schemes until the upgrade is deployed

Patch Information

The fix landed in HTTP::Tiny 0.093 and is documented in the MetaCPAN release changes. The corresponding source change is in the GitHub commit patch. The patch validates header field values against the RFC 7230 Field_Content grammar and rejects request method, URI, and host components containing CRLF.

Workarounds

Validate and sanitize URLs at the application layer using URI module parsing, then reject any component containing \r, \n, or percent-encoded equivalents before invocation
Wrap HTTP::Tiny calls in a helper that scans all header values for control characters and refuses requests that contain them
Restrict outbound traffic from Perl services through a forward proxy that enforces strict HTTP/1.1 framing

bash

# Upgrade HTTP::Tiny to the patched release
cpanm HTTP::Tiny@0.093

# Verify installed version
perl -MHTTP::Tiny -e 'print $HTTP::Tiny::VERSION, "\n"'