Executive brief
HTTP::Tiny, a popular Perl library used for making web requests, fails to properly check for special characters in web addresses and headers. This flaw allows an attacker to manipulate web requests, potentially bypassing security controls or tricking internal servers into performing unauthorized actions. Organizations using Perl applications that process user-provided URLs should update the library to prevent request smuggling attacks.
Technical details
HTTP::Tiny versions prior to 0.093 are vulnerable to HTTP Request Smuggling and Header Injection (CWE-113). The library fails to validate CRLF sequences in the HTTP request method, URI, Host header, and other control data field values. An attacker who can control these inputs—such as through a user-supplied URL passed to a webhook or fetch endpoint—can inject arbitrary headers or split the HTTP request. This can be used to bypass security filters or communicate with upstream servers in an unintended manner. The issue is resolved in version 0.093-TRIAL and later by implementing stricter validation of printable characters and CRLF sequences in request components.
Affected products
- Perl-Toolchain-Gang HTTP::Tiny < 0.093
Timeline
- 2026-04-25: other: Issue discovered
- 2026-05-11: patched: HTTP-Tiny 0.093-TRIAL published with fix
- 2026-05-11: disclosed: Public advisory released