HTTP::Tiny Header Injection and Request Smuggling Vulnerability

A vulnerability in HTTP::Tiny versions prior to 0.093 for Perl allows for header injection and request smuggling attacks. The issue arises because the library does not properly validate carriage return and line feed (CRLF) characters in HTTP request lines and control field header values. This lack of validation can be exploited by injecting additional headers or manipulating request lines, potentially leading to unauthorized actions on the upstream server.

Impact

Exploitation of this vulnerability could result in header injection and request smuggling, allowing an attacker to manipulate HTTP requests and headers sent to an upstream server.

Remediation

Users can upgrade to HTTP::Tiny version 0.093 or later, where this vulnerability has been addressed.