HAARG HTTP::Tiny versions prior to 0.093 for Perl do not validate carriage return and line feed (CRLF) characters in HTTP request lines or control field header values. Specifically, the method, URI, URL host (which forms the Host header), and HTTP/1.1 control data field values are susceptible to injection of CRLF sequences. An attacker who can supply these inputs, such as through user-supplied URLs passed to webhook or URL fetch endpoints, can inject additional HTTP headers and smuggle requests to upstream servers, leading to HTTP request/response splitting vulnerabilities classified under CWE-113.

The vulnerability allows attackers to inject arbitrary HTTP headers and manipulate HTTP requests sent to upstream servers. This can lead to HTTP request/response splitting attacks, potentially enabling cache poisoning, cross-site scripting, or other HTTP-level attacks depending on the context in which HTTP::Tiny is used. However, no known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid passing untrusted input directly to HTTP::Tiny request lines or headers. Implement input validation or sanitization to prevent CRLF injection in HTTP method, URI, and header values.