Hi,
The following vulnerabilities were published for rust-tiny-http.
Filling this issue at RC level since upstream maintenance seems to
have stopped with the 0.12.0 release, is it still maintained
(upstream) should it be removed from unstable?
CVE-2026-66752[0]:
| tiny-http through 0.12.0 contains an HTTP request smuggling
| vulnerability that allows remote attackers to desynchronize request
| framing by sending a Transfer-Encoding header with any value,
| including non-chunked codings, which causes the library to
| unconditionally apply chunk-decoding and discard Content-Length.
| Attackers can exploit the discrepancy between tiny_http's improper
| Transfer-Encoding parsing and a correctly-implemented front-end
| proxy to produce two distinct interpretations of a single byte
| stream, enabling request smuggling, and can additionally send non-
| chunked bodies with non-chunked Transfer-Encoding values to cause
| failed body reads that tie up connections and consume worker threads
| without signaling errors to clients.
CVE-2026-66753[1]:
| tiny-http through 0.12.0 contains an HTTP header injection
| vulnerability that allows attackers to inject carriage return (0x0D)
| and line feed (0x0A) bytes into HTTP header values on both request
| and response sides due to insufficient validation in header parsing
| and serialization. Attackers can exploit this injection primitive to
| perform response splitting, cache poisoning, session fixation via
| Set-Cookie injection, security header override, and request
| smuggling against line-feed-tolerant backends.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-66752
https://www.cve.org/CVERecord?id=CVE-2026-66752
https://github.com/tiny-http/tiny-http/issues/287
[1] https://security-tracker.debian.org/tracker/CVE-2026-66753
https://www.cve.org/CVERecord?id=CVE-2026-66753
https://github.com/tiny-http/tiny-http/issues/288
Regards,
Salvatore