The vulnerability in rust-tiny-http (<=0.12.0) allows injection of CR (0x0D) and LF (0x0A) bytes into HTTP header values due to inadequate validation in header parsing and serialization. This enables attackers to perform HTTP response splitting, cache poisoning, session fixation through Set-Cookie header manipulation, override security headers, and conduct request smuggling attacks on line-feed-tolerant backend systems. The issue is categorized under CWE-113 (Improper Neutralization of CRLF Sequences in HTTP Headers). There is no vendor advisory or patch information available to confirm remediation status.

Successful exploitation can lead to HTTP response splitting, cache poisoning, session fixation, security header override, and request smuggling attacks. These impacts can compromise web application behavior and security controls relying on HTTP headers. The CVSS score of 3.7 indicates a moderate impact primarily affecting integrity, with no direct confidentiality or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider mitigating risks by validating and sanitizing HTTP header inputs at application or proxy layers if feasible. Monitor vendor channels for updates regarding an official fix.