tiny‑http versions up to 0.12.0 parse and serialize HTTP headers without checking for carriage return (0x0D) and line feed (0x0A) characters, allowing an attacker to inject these bytes into any header value on both request and response sides. The resulting HTTP header injection can be used for response splitting, cache poisoning, session fixation through Set‑Cookie injection, overriding critical security headers, and request smuggling against back‑end services that tolerate line feeds. The base weakness is identified as CWE‑113, which directly impacts the integrity of HTTP traffic and can lead to confidentiality, integrity, and availability violations for users of the affected application.

The vulnerability affects the tiny‑http library provided by the vendor "tiny-http:tiny-http" and specifically applies to releases through 0.12.0. No other affected versions are listed in the current data.

The CVSS score of 6.3 indicates moderate severity. The EPSS score is less than 1 %, suggesting a low likelihood of exploitation at the time of analysis. The vulnerability is not currently indexed in CISA’s KEV catalog. Based on the description, the likely attack vector is a remote attacker sending a crafted HTTP request that includes CR‑LF sequences in header values, triggering a split response that can be leveraged for the aforementioned attacks. No additional exploitation prerequisites beyond sending the malicious request are noted in the data.