HTTP Header Injection in tiny-http

Executive Summary

CVE-2026-66753 is an HTTP header injection vulnerability in the tiny-http library up to version 0.12.0. It allows attackers to inject carriage return (0x0D) and line feed (0x0A) characters into HTTP header values due to insufficient validation during parsing and serialization. This can lead to response splitting, cache poisoning, session fixation, security header override, and request smuggling against line-feed-tolerant backends.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect HTTP traffic for header values containing CR (0x0D) or LF (0x0A) characters. Use tools like Wireshark or tcpdump to capture and analyze HTTP headers for unexpected line breaks. Check server logs for malformed requests or responses with split headers. Test applications using tiny-http 0.12.0 or earlier by sending crafted headers with CR/LF sequences and observing if they are reflected or split in responses.

• Use curl to send test headers: curl -v -H "Test: value%0d%0aInjected-Header: test" http://target. Example shows how CR/LF may be processed.
• Monitor for response splitting by checking if headers appear split across multiple lines in responses, indicating CRLF injection.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to manipulate HTTP headers, leading to attacks like response splitting, cache poisoning, session fixation via Set-Cookie injection, security header override, and request smuggling. If your application uses tiny-http versions up to 0.12.0, it may be vulnerable to these exploits.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling session fixation, security header overrides, and cache poisoning. These attacks may lead to unauthorized access to sensitive data or manipulation of user sessions, which are critical concerns under both regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade tiny-http to a patched version beyond 0.12.0 if available. If upgrading is not possible, implement input validation to reject header values containing CR, LF, or null bytes during parsing. Modify the read_next_line, Header::from_str, or Header::from_bytes functions to enforce strict validation of header fields and values.

• Apply network-level mitigations such as WAF rules to block requests with suspicious header patterns containing CR/LF sequences.
• Audit all applications using tiny-http for exposure to header injection and test for potential exploitation vectors like request smuggling or response splitting.

Useful 0 Not Useful 0