HTTP::Tiny versions before 0.093 accept control characters in the request line and in HTTP/1.1 control data without validating them. This omission allows an attacker who controls the method, URI, host header, or other HTTP/1.1 control fields to inject additional header lines into the request. The injected headers can alter how the upstream server interprets the request, leading to HTTP request smuggling or other header manipulation scenarios. The weakness is a lack of CRLF validation (CWE‑113).

HAARG HTTP::Tiny. All releases prior to 0.093 are vulnerable. Applications that embed any of those older versions are susceptible. The fix is delivered in the 0.093‑TRIAL package and later revisions.

The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, indicating no public evidence of exploitation yet. Exploitation requires the attacker to control input that is passed directly to HTTP::Tiny, such as a user‑supplied URL supplied to a webhook or fetch routine. When this condition is satisfied, request smuggling or header manipulation can occur. The CVSS score of 6.5 indicates moderate impact on request integrity, which justifies timely remediation.