{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"rust-tiny-http","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":[],"id":"tcs_01M5NTNMJ7Y4FE1KCKB5Q4FKGK","modified_at":"2026-10-01T03:03:38.691219969Z","published_at":"2026-07-28T16:20:17.093Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-66753","https://security-tracker.debian.org/tracker/CVE-2026-66753"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-66753#Debian:13/rust-tiny-http","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-66753"}],"summary":"tiny-http through 0.12.0 contains an HTTP header injection vulnerability that allows attackers to inject carriage return (0x0D) and line feed (0x0A) bytes into HTTP header values on both request and r"}