HAARG HTTP::Tiny versions prior to 0.093 do not properly validate CRLF characters in HTTP request lines and control field header values. Specifically, the method, URI, and URL host inputs are not sanitized, enabling an attacker who can control these inputs to inject additional HTTP headers and smuggle requests to upstream servers. This vulnerability is classified as CWE-113 (Improper Neutralization of CRLF Sequences in HTTP Headers). The CVSS 3.1 base score is 6.5 (medium severity) with network attack vector, low complexity, no privileges or user interaction required, and impacts confidentiality and integrity but not availability. There is no vendor advisory or patch information available at this time.

An attacker able to supply malicious input to the HTTP::Tiny client (such as a user-controlled URL in a webhook or URL fetch) can inject CRLF sequences to add headers or split HTTP requests. This can lead to HTTP request/response splitting attacks, potentially allowing header injection and request smuggling to upstream servers. The impact affects confidentiality and integrity of HTTP communications but does not affect availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid passing untrusted input directly to HTTP::Tiny request lines or headers. Implement input validation or sanitization to remove CRLF characters from user-controlled inputs before use. Monitor vendor channels for updates and patches.