========================================================================
CVE-2026-7010                                        CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-7010
  Distribution:  HTTP-Tiny
      Versions:  before 0.093

      MetaCPAN:  https://metacpan.org/dist/HTTP-Tiny
      VCS Repo:  https://github.com/Perl-Toolchain-Gang/HTTP-Tiny

HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP
request lines or control field header values

Description
-----------
HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP
request lines or control field header values.

The unvalidated inputs are the method and URI in the request line, the
URL host that becomes the `Host:` header, and HTTP/1.1 control data
field values.

An attacker who controls one of these inputs, for example a user
supplied URL passed to a webhook or URL fetch endpoint, can inject
additional headers and smuggle requests to the upstream server.

Problem types
-------------
- CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers
  ('HTTP Request/Response Splitting')

Solutions
---------
Upgrade to HTTP-Tiny 0.093-TRIAL or later.

References
----------
https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/d73c7651e82ace02693842df55928b6c3ae7c38d.patch
https://metacpan.org/release/HAARG/HTTP-Tiny-0.093-TRIAL/changes

Timeline
--------
- 2026-04-25: Issue discovered.
- 2026-05-11: HTTP-Tiny 0.093-TRIAL published with fix.