tiny-http CVE-2026-66753

Q: What is the CVSS score of CVE-2026-66753?

CVE-2026-66753 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-49883 MEDIUM

HTTP Response Splitting (CWE-113)

2026-07-28 disclosure@vulncheck.com

GHSA-5wm6-g4fr-88x8

Code Injection

6.3

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Network attack vector, low complexity, no privileges required, no user interaction, low integrity impact only.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 16:42 vuln.today

DescriptionCVE.org

tiny-http through 0.12.0 contains an HTTP header injection vulnerability that allows attackers to inject carriage return (0x0D) and line feed (0x0A) bytes into HTTP header values on both request and response sides due to insufficient validation in header parsing and serialization. Attackers can exploit this injection primitive to perform response splitting, cache poisoning, session fixation via Set-Cookie injection, security header override, and request smuggling against line-feed-tolerant backends.

AnalysisAI

Header injection vulnerability in tiny-http through version 0.12.0 allows attackers to inject CRLF bytes into HTTP header values, enabling response splitting, cache poisoning, and session fixation. No active exploitation reported, but proof-of-concept code is publicly available in a GitHub repository. The library's insufficient validation of header values enables this injection primitive against line-feed-tolerant backends.

Technical ContextAI

The vulnerability is a CRLF injection (CWE-113) in the HTTP header parsing and serialization logic of tiny-http, a Rust library for handling HTTP requests and responses. The library fails to strip or reject carriage return (0x0D) and line feed (0x0A) bytes from header values, allowing attackers to inject arbitrary headers and body content. This injection occurs at the protocol level, affecting both request and response headers. The CPE data is not available, but the affected product is the tiny-http crate up to version 0.12.0. The root cause is insufficient input validation, a classic class of injection vulnerabilities in text-based protocols.

RemediationAI

No vendor-released patch identified at time of analysis. As a workaround, implement strict input validation on all header values by stripping or rejecting carriage return (0x0D) and line feed (0x0A) bytes before passing them to tiny-http's header parsing functions. Additionally, ensure that any application-level header generation (e.g., reflecting user input) sanitizes output. Consider replacing tiny-http with an actively maintained HTTP library that enforces proper CRLF handling. These mitigations may require code changes but do not affect basic HTTP functionality; however, removing support for legitimate multi-line headers (though rare) could break some backends. Regularly monitor the tiny-http repository for future security patches.