---
title: "CVE-2026-7010\n    | Ubuntu"
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2026-7010?format=md
keywords: index, follow
---

# CVE-2026-7010

Publication date 11 May 2026

Last updated 14 May 2026

---

Ubuntu priority

**Medium**

[Why this priority?](https://ubuntu.com/security/cves/about#priority )

## Cvss 3 Severity Score

**6.5 · Medium**

[Score breakdown](https://ubuntu.com/security/CVE-2026-7010?format=md#impact-score)

Toggle side navigation

## Description

HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP
request lines or control field header values.
The unvalidated inputs are the method and URI in the request line, the URL
host that becomes the `Host:` header, and HTTP/1.1 control data field
values.
An attacker who controls one of these inputs, for example a user supplied
URL passed to a webhook or URL fetch endpoint, can inject additional
headers and smuggle requests to the upstream server.

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| libhttp-tiny-perl | 26.04 LTS resolute | Needs evaluation |
| 25.10 questing | Ignored end of life, was needs-triage |
| 24.04 LTS noble | Needs evaluation |
| 22.04 LTS jammy | Needs evaluation |
| 20.04 LTS focal | Needs evaluation |
| 18.04 LTS bionic | Needs evaluation |
| 16.04 LTS xenial | Needs evaluation |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)

## Severity score breakdown

CVSS version:
CVSS v3.0

**Base score**

6.5 · Medium

* Base metrics

  | Parameter | Value |
  | --- | --- |
  | Attack vector | Network |
  | Attack complexity | Low |
  | Privileges required | None |
  | User interaction | None |
  | Scope | Unchanged |
  | Confidentiality impact | Low |
  | Integrity impact | Low |
  | Availability impact | None |
* Scores

  | Parameter | Value |
  | --- | --- |
  | Base score | 6.5 · Medium |
  | Exploitability score | - |
  | Impact score | - |

**Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7010)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-7010)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2026-7010)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2026-7010)

### Other references

* <https://www.cve.org/CVERecord?id=CVE-2026-7010>
* <https://lists.security.metacpan.org/cve-announce/msg/39952806/>