What is CVE-2026-66753?

CVE-2026-66753 is a low-severity vulnerability in Tiny-http, classified under HTTP Response Splitting. CVSS score: 3.7/10. Published 2026-07-28.

How severe is CVE-2026-66753?

Low severity. CVSS v3 base score is 3.7 out of 10.

Vulnerability in Tiny-http

CVE-2026-66753

tiny-http through 0.12.0 contains an HTTP header injection vulnerability that allows attackers to inject carriage return (0x0D) and line feed (0x0A) bytes into HTTP header values on both request and response sides due to insufficient valid…

CVSS v3 metric

CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N.

Affected products

Tiny-http — versions 0

Weakness classification (CWE)

CWE-113 — HTTP Response Splitting

References

disclosure@vulncheck.com (technical-description, exploit)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-66753?: CVE-2026-66753 is a low-severity vulnerability in Tiny-http, classified under HTTP Response Splitting. CVSS score: 3.7/10. Published 2026-07-28.
How severe is CVE-2026-66753?: Low severity. CVSS v3 base score is 3.7 out of 10.