Threat Intelligence Database

HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire. The HTTP::Tiny POD note that "Authorization headers will not be included in a redirected request" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.

CVE-2026-7010 is a medium severity vulnerability in HAARG HTTP::Tiny versions before 0.093 for Perl. The issue arises from improper validation of CRLF sequences in HTTP request lines and control field header values, allowing an attacker controlling inputs such as the HTTP method, URI, or host header to inject additional headers and perform HTTP request/response splitting attacks. This can lead to smuggling requests to upstream servers. No official patch or remediation guidance is currently available.