{"id":"UBUNTU-CVE-2026-7010","details":"HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values. The unvalidated inputs are the method and URI in the request line, the URL host that becomes the `Host:` header, and HTTP/1.1 control data field values. An attacker who controls one of these inputs, for example a user supplied URL passed to a webhook or URL fetch endpoint, can inject additional headers and smuggle requests to the upstream server.","modified":"2026-05-26T19:29:39.593620644Z","published":"2026-05-11T22:22:00Z","upstream":["CVE-2026-7010"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-7010"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-7010"},{"type":"REPORT","url":"https://lists.security.metacpan.org/cve-announce/msg/39952806/"}],"affected":[{"package":{"name":"libhttp-tiny-perl","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/libhttp-tiny-perl?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.056-1"],"ecosystem_specific":{"binaries":[{"binary_name":"libhttp-tiny-perl","binary_version":"0.056-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-7010.json"}},{"package":{"name":"libhttp-tiny-perl","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/libhttp-tiny-perl?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.070-1"],"ecosystem_specific":{"binaries":[{"binary_name":"libhttp-tiny-perl","binary_version":"0.070-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-7010.json"}},{"package":{"name":"libhttp-tiny-perl","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/libhttp-tiny-perl?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.076-1"],"ecosystem_specific":{"binaries":[{"binary_name":"libhttp-tiny-perl","binary_version":"0.076-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-7010.json"}},{"package":{"name":"libhttp-tiny-perl","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/libhttp-tiny-perl?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.076-1","0.080-1"],"ecosystem_specific":{"binaries":[{"binary_name":"libhttp-tiny-perl","binary_version":"0.080-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-7010.json"}},{"package":{"name":"libhttp-tiny-perl","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/libhttp-tiny-perl?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.082-2","0.088-1"],"ecosystem_specific":{"binaries":[{"binary_name":"libhttp-tiny-perl","binary_version":"0.088-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-7010.json"}},{"package":{"name":"libhttp-tiny-perl","ecosystem":"Ubuntu:25.10","purl":"pkg:deb/ubuntu/libhttp-tiny-perl?arch=source&distro=questing"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.090-1"],"ecosystem_specific":{"binaries":[{"binary_version":"0.090-1","binary_name":"libhttp-tiny-perl"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-7010.json"}},{"package":{"name":"libhttp-tiny-perl","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/libhttp-tiny-perl?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.090-1","0.092-1"],"ecosystem_specific":{"binaries":[{"binary_version":"0.092-1","binary_name":"libhttp-tiny-perl"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-7010.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},{"type":"Ubuntu","score":"medium"}]}