Threats tagged 'ghsa-5wm6-g4fr-88x8'

Rust tiny-http versions up to 0.12.0 contain an HTTP header injection vulnerability that permits attackers to inject carriage return and line feed characters into HTTP header values. This flaw arises from insufficient validation during header parsing and serialization on both request and response sides. Exploitation can lead to response splitting, cache poisoning, session fixation via Set-Cookie injection, security header override, and request smuggling against backends tolerant to line feeds. The vulnerability is tracked as CVE-2026-66753 and has a medium severity rating with a CVSS score of 3.7. No official patch or fix information is currently provided.