HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values. The unvalidated inputs are the method and URI in the request line, the URL host that becomes the `Host:` header, and HTTP/1.1 control data field values. An attacker who controls one of these inputs, for example a user supplied URL passed to a webhook or URL fetch endpoint, can inject additional headers and smuggle requests to the upstream server.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-703a749924 advisory.

    0.094 - fix to prevent invalid characters in all headers, and prevent header smuggling (CVE-2026-7010)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:20792-1 advisory.

    Changes in perl-HTTP-Tiny:

    - updated to 0.094       0.094
          - No changes from 0.093-TRIAL       0.093
          - fix to prevent invalid characters in all headers, and prevent header             smuggling (CVE-2026-7010) bsc#1264992

    - updated to 0.092       0.092
          - No changes from 0.091-TRIAL       0.091           [ADDED]
          - Added keep_alive_timeout to force keepalive connections to be closed             based on a timeout.
          [CHANGED]
          - Optional tests are always required when releasing.
          - Always use TCP_NODELAY option.
          [FIXED]
          - Fixed test incorrectly testing cookie jar interactions multiple times.
          - Fixed perl version comparisons to work when not starting with 5.
          - Fixed link to LIMITATIONS in documentation.

    - updated to 0.090       0.090
          - No changes from 0.089-TRIAL       0.089           [CHANGED]
          - Find the certificate bundle via IO::Socket::SSL rather than implementing             it in HTTP::Tiny.
          - When encoding form data, given a hashref with an arrayref value,             preserve the order of the values in the arrayref rather than sorting.
          [DOCS]
          - Fixed internal link to TLS/SSL SUPPORT section

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field     header values. The unvalidated inputs are the method and URI in the request line, the URL host that     becomes the `Host:` header, and HTTP/1.1 control data field values. An attacker who controls one of these     inputs, for example a user supplied URL passed to a webhook or URL fetch endpoint, can inject additional     headers and smuggle requests to the upstream server. (CVE-2026-7010)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
317020	Fedora 44 : perl-HTTP-Tiny (2026-703a749924)	Nessus	Fedora Local Security Checks	medium
316761	openSUSE 16 Security Update : perl-HTTP-Tiny (openSUSE-SU-2026:20792-1)	Nessus	SuSE Local Security Checks	medium
314294	Linux Distros Unpatched Vulnerability : CVE-2026-7010	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-7010

medium

Tenable Plugins

medium

medium

medium