HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values. The unvalidated inputs are the method and URI in the request line, the URL host that becomes the `Host:` header, and HTTP/1.1 control data field values. An attacker who controls one of these inputs, for example a user supplied URL passed to a webhook or URL fetch endpoint, can inject additional headers and smuggle requests to the upstream server.

According to the versions of the perl-HTTP-Tiny packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field     header values.The unvalidated inputs are the method and URI in the request line, the URL host that becomes     the `Host:` header, and HTTP/1.1 control data field values.An attacker who controls one of these inputs,     for example a user supplied URL passed to a webhook or URL fetch endpoint, can inject additional headers     and smuggle requests to the upstream server.(CVE-2026-7010)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization perl-HTTP-Tiny security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the perl-HTTP-Tiny packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field     header values.

    The unvalidated inputs are the method and URI in the request line, the URL host that becomes the `Host:`     header, and HTTP/1.1 control data field values.

    An attacker who controls one of these inputs, for example a user supplied URL passed to a webhook or URL     fetch endpoint, can inject additional headers and smuggle requests to the upstream server.(CVE-2026-7010)

Tenable has extracted the preceding description block directly from the EulerOS perl-HTTP-Tiny security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the perl-HTTP-Tiny packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field     header values._x000D_
    _x000D_     The unvalidated inputs are the method and URI in the request line, the URL host that becomes the `Host:`     header, and HTTP/1.1 control data field values._x000D_
    _x000D_     An attacker who controls one of these inputs, for example a user supplied URL passed to a webhook or URL     fetch endpoint, can inject additional headers and smuggle requests to the upstream server.(CVE-2026-7010)

Tenable has extracted the preceding description block directly from the EulerOS perl-HTTP-Tiny security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of perl-HTTP-Tiny installed on the remote host is prior to 0.033-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3326 advisory.

    HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field     header values.

    The unvalidated inputs are the method and URI in the request line, the URL host that becomes the `Host:`     header, and HTTP/1.1 control data field values.

    An attacker who controls one of these inputs, for example a user supplied URL passed to a webhook or URL     fetch endpoint, can inject additional headers and smuggle requests to the upstream server. (CVE-2026-7010)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1765 advisory.

    HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field     header values.

    The unvalidated inputs are the method and URI in the request line, the URL host that becomes the `Host:`     header, and HTTP/1.1 control data field values.

    An attacker who controls one of these inputs, for example a user supplied URL passed to a webhook or URL     fetch endpoint, can inject additional headers and smuggle requests to the upstream server. (CVE-2026-7010)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-3bfb774625 advisory.

    0.094 - fix to prevent invalid characters in all headers, and prevent header smuggling (CVE-2026-7010)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-703a749924 advisory.

    0.094 - fix to prevent invalid characters in all headers, and prevent header smuggling (CVE-2026-7010)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:20792-1 advisory.

    Changes in perl-HTTP-Tiny:

    - updated to 0.094       0.094
          - No changes from 0.093-TRIAL       0.093
          - fix to prevent invalid characters in all headers, and prevent header             smuggling (CVE-2026-7010) bsc#1264992

    - updated to 0.092       0.092
          - No changes from 0.091-TRIAL       0.091           [ADDED]
          - Added keep_alive_timeout to force keepalive connections to be closed             based on a timeout.
          [CHANGED]
          - Optional tests are always required when releasing.
          - Always use TCP_NODELAY option.
          [FIXED]
          - Fixed test incorrectly testing cookie jar interactions multiple times.
          - Fixed perl version comparisons to work when not starting with 5.
          - Fixed link to LIMITATIONS in documentation.

    - updated to 0.090       0.090
          - No changes from 0.089-TRIAL       0.089           [CHANGED]
          - Find the certificate bundle via IO::Socket::SSL rather than implementing             it in HTTP::Tiny.
          - When encoding form data, given a hashref with an arrayref value,             preserve the order of the values in the arrayref rather than sorting.
          [DOCS]
          - Fixed internal link to TLS/SSL SUPPORT section

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field     header values. The unvalidated inputs are the method and URI in the request line, the URL host that     becomes the `Host:` header, and HTTP/1.1 control data field values. An attacker who controls one of these     inputs, for example a user supplied URL passed to a webhook or URL fetch endpoint, can inject additional     headers and smuggle requests to the upstream server. (CVE-2026-7010)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
339291	EulerOS Virtualization 2.13.0 : perl-HTTP-Tiny (EulerOS-SA-2026-3228)	Nessus	Huawei Local Security Checks	Local	medium
339274	EulerOS Virtualization 2.13.1 : perl-HTTP-Tiny (EulerOS-SA-2026-3188)	Nessus	Huawei Local Security Checks	Local	medium
333449	EulerOS 2.0 SP11 : perl-HTTP-Tiny (EulerOS-SA-2026-3087)	Nessus	Huawei Local Security Checks	Local	medium
333439	EulerOS 2.0 SP11 : perl-HTTP-Tiny (EulerOS-SA-2026-3141)	Nessus	Huawei Local Security Checks	Local	medium
332950	EulerOS 2.0 SP13 : perl-HTTP-Tiny (EulerOS-SA-2026-2986)	Nessus	Huawei Local Security Checks	Local	medium
332849	EulerOS 2.0 SP13 : perl-HTTP-Tiny (EulerOS-SA-2026-3036)	Nessus	Huawei Local Security Checks	Local	medium
332810	EulerOS 2.0 SP15 : perl-HTTP-Tiny (EulerOS-SA-2026-2940)	Nessus	Huawei Local Security Checks	Local	medium
332796	EulerOS 2.0 SP15 : perl-HTTP-Tiny (EulerOS-SA-2026-2899)	Nessus	Huawei Local Security Checks	Local	medium
319846	Amazon Linux 2 : perl-HTTP-Tiny, --advisory ALAS2-2026-3326 (ALAS-2026-3326)	Nessus	Amazon Linux Local Security Checks	Local	medium
319769	Amazon Linux 2023 : perl-HTTP-Tiny, perl-HTTP-Tiny-tests (ALAS2023-2026-1765)	Nessus	Amazon Linux Local Security Checks	Local	medium
318770	Fedora 43 : perl-HTTP-Tiny (2026-3bfb774625)	Nessus	Fedora Local Security Checks	Local	medium
317020	Fedora 44 : perl-HTTP-Tiny (2026-703a749924)	Nessus	Fedora Local Security Checks	Local	medium
316761	openSUSE 16 Security Update : perl-HTTP-Tiny (openSUSE-SU-2026:20792-1)	Nessus	SuSE Local Security Checks	Local	medium
314294	Linux Distros Unpatched Vulnerability : CVE-2026-7010	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-7010

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium