Skip to content
Fencer Vulns
high 8.1

CVE-2023-31486 json

HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where…

published 2023-04-28 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-35791

cvss
8.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.7%
EPSS 1.7% chance of exploitation in 30 days, percentile 77%
public exploits
0
none known

Summary

HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.

Patch / fix

  • http::tiny_project http::tiny 0.083
  • perl perl 5.38.0
  • perl Debian 14, Debian 13 5.38.2-2
  • libhttp-tiny-perl Debian 14, Debian 13 0.088-1

debian advisories DEBIAN-CVE-2023-31486

  • perl hummingbird 1 5.42.2-524.1.hum1
  • perl-B hummingbird 1 1.89-524.1.hum1
  • perl-if hummingbird 1 0.61.000-524.1.hum1
  • perl-IO hummingbird 1 1.55-524.1.hum1
  • perl-ph hummingbird 1 5.42.2-524.1.hum1
  • perl-lib hummingbird 1 0.65-524.1.hum1
  • perl-mro hummingbird 1 1.29-524.1.hum1
  • perl-Net hummingbird 1 1.04-524.1.hum1

red hat advisories RHSA-2026:7604RHSA-2024:4430RHSA-2024:0579RHSA-2024:0422RHSA-2023:7174RHSA-2023:6542

  • perl-HTTP-Tiny openSUSE Tumbleweed 0.086-1.1
  • perl-HTTP-Tiny Package Hub 15 SP5, openSUSE Leap 15.5 0.086-bp155.3.3.1
  • perl-HTTP-Tiny Package Hub 15 SP4, openSUSE Leap 15.4 0.086-bp154.2.3.1

opensuse advisories openSUSE-SU-2024:13034-1openSUSE-SU-2023:0223-1openSUSE-SU-2023:0222-1

  • perl-HTTP-Tiny AlmaLinux 8 0.074-2.el8
  • perl-HTTP-Tiny AlmaLinux 9 0.076-461.el9

almalinux advisories ALSA-2023:7174ALSA-2023:6542

  • perl CBL-Mariner 2.0 5.34.1-489

azure linux advisories AZL-37127

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-31486 updated cvss 8.1

http-tiny: perl: insecure TLS cert default

  • Red Hat Enterprise Linux 7 perl-HTTP-Tiny
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 perl-HTTP-Tiny
    affected: no fix available
  • Red Hat Enterprise Linux AppStream (v. 9) perl-HTTP-Tiny 0.076-461.el9
    fixed: vendor fix RHSA-2023:6542
  • Red Hat Enterprise Linux AppStream EUS (v.9.2) perl-HTTP-Tiny 0.076-461.el9_2
    fixed: vendor fix RHSA-2024:4430
  • Red Hat Enterprise Linux BaseOS (v. 8) perl-HTTP-Tiny 0.074-2.el8
    fixed: vendor fix RHSA-2023:7174
  • Red Hat Enterprise Linux BaseOS EUS (v.8.6) perl-HTTP-Tiny 0.074-1.el8_6.1
    fixed: vendor fix RHSA-2024:0422
  • Red Hat Enterprise Linux BaseOS EUS (v.8.8) perl-HTTP-Tiny 0.074-1.el8_8.2
    fixed: vendor fix RHSA-2024:0579
  • Red Hat Hardened Images perl 5.42.2-524.1.hum1, perl-B 1.89-524.1.hum1, perl-IO 1.55-524.1.hum1, perl-Tie 4.6-524.1.hum1, perl-lib 0.65-524.1.hum1, perl-mro 1.29-524.1.hum1, +93 more
    fixed: vendor fix RHSA-2026:7604

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
21 mo ago

Exploit prediction

1.74% chance of exploitation in the next 30 days, higher than 77% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

Weakness
  • CWE-295 Improper Certificate Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.