High
Security advisory
HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2023-31486
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 2 Nov 2026, 18:58 UTC · Revision 1
Source evidence
HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.
osv:CVE-2023-31486
Complete source record
{
"id": "e84fcdf811911d88a3168ace59fa2f7e52d3a4eabcdf3a308adb59dba803bfa3",
"url": "https://osv.dev/vulnerability/CVE-2023-31486",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2023-31486",
"summary": "HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.",
"evidence": "osv:CVE-2023-31486",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2023-31486",
"aliases": [
"CVE-2023-31486"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/chansen/p5-http-tiny",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "d7705dc05a0f64dfeaeca46c8a49b19656f4f3d3"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "0.083"
}
],
"source": "DESCRIPTION"
},
{
"cpe": "cpe:2.3:a:http\\:\\:tiny_project:http\\:\\:tiny:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "0.083"
}
],
"source": "CPE_RANGE"
}
]
}
},
{
"repo": "https://github.com/perl/perl5",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "76298ae68aa7796f0ffc05095b127d23f4b2de8f"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "5.38.0"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"release-0.082",
"release-0.081",
"release-0.080",
"release-0.079",
"release-0.078",
"release-0.077",
"release-0.076",
"release-0.075",
"release-0.074",
"release-0.073",
"release-0.071",
"release-0.070",
"release-0.069",
"release-0.068",
"release-0.067",
"release-0.065",
"release-0.064",
"release-0.063",
"release-0.061",
"release-0.059",
"release-0.058",
"release-0.057",
"release-0.056",
"release-0.055",
"release-0.054",
"release-0.053",
"release-0.052",
"release-0.051",
"release-0.050",
"release-0.049",
"release-0.048",
"release-0.047",
"release-0.046",
"release-0.045",
"release-0.044",
"release-0.043",
"release-0.042",
"release-0.041",
"release-0.040",
"release-0.039",
"release-0.038",
"release-0.037",
"release-0.036",
"release-0.035",
"release-0.034",
"release-0.033",
"release-0.032",
"release-0.031",
"release-0.030",
"release-0.029",
"release-0.028",
"release-0.027",
"release-0.026",
"release-0.025",
"release-0.024",
"release-0.023",
"release-0.022",
"release-0.021",
"release-0.020",
"release-0.019",
"release-0.018",
"release-0.017",
"release-0.016",
"release-0.015",
"release-0.014",
"release-0.013",
"release-0.012",
"release-0.011",
"release-0.010",
"release-0.009",
"release-0.008",
"release-0.007",
"release-0.006",
"release-0.005",
"release-0.004",
"release-0.003",
"release-0.002",
"release-0.001",
"v5.38.0-RC2",
"v5.38.0-RC1",
"v5.37.11",
"v5.37.10",
"v5.37.9",
"v5.37.7",
"v5.37.6",
"v5.37.5",
"v5.37.4",
"v5.37.3",
"v5.37.2",
"v5.37.1",
"v5.36.0",
"v5.37.0",
"v5.36.0-RC3",
"v5.35.11",
"v5.35.10",
"v5.34.0",
"v5.35.9",
"v5.35.8",
"v5.35.6",
"v5.35.5",
"v5.35.3",
"v5.35.0",
"v5.34.0-RC2",
"v5.34.0-RC1",
"v5.33.9",
"v5.33.8",
"v5.33.7",
"v5.32.0",
"v5.33.4",
"v5.33.3",
"v5.33.2",
"v5.33.1",
"v5.33.0",
"v5.32.0-RC1",
"v5.31.11",
"v5.31.7",
"v5.31.5",
"v5.30.0",
"v5.31.4",
"v5.31.3",
"v5.31.2",
"v5.31.1",
"v5.31.0",
"v5.30.0-RC2",
"v5.30.0-RC1",
"v5.29.10",
"v5.29.9",
"v5.29.8",
"v5.29.7",
"v5.29.6",
"v5.29.5",
"v5.28.0",
"v5.29.1",
"v5.29.0",
"v5.28.0-RC4",
"v5.28.0-RC3",
"v5.28.0-RC2",
"v5.28.0-RC1",
"v5.27.11",
"v5.27.10",
"v5.27.8",
"v5.27.7",
"v5.27.6",
"v5.27.5",
"v5.27.3",
"v5.26.0",
"v5.27.0",
"v5.26.0-RC2",
"v5.25.11",
"v5.25.9",
"v5.25.7",
"v5.25.5",
"v5.25.4",
"v5.25.3",
"v5.24.0",
"v5.25.2",
"v5.25.0",
"v5.24.0-RC5",
"v5.24.0-RC4",
"v5.24.0-RC3",
"v5.24.0-RC2",
"v5.24.0-RC1",
"v5.23.7",
"v5.23.6",
"v5.23.4",
"v5.23.3",
"if-0.0605",
"v5.23.2",
"v5.23.1",
"v5.23.0",
"v5.22.0",
"v5.22.0-RC2",
"v5.22.0-RC1",
"v5.21.11",
"if-0.0604",
"v5.21.10",
"v5.21.9",
"v5.21.8",
"v5.21.6",
"v5.21.5",
"v5.21.4",
"v5.21.1",
"v5.21.0",
"v5.20.0",
"v5.20.0-RC1",
"v5.19.11",
"v5.19.7",
"v5.19.5",
"v5.19.3",
"v5.19.2",
"if-0.0603",
"v5.19.1",
"v5.18.0",
"v5.19.0",
"v5.18.0-RC4",
"v5.18.0-RC3",
"v5.18.0-RC2",
"v5.18.0-RC1",
"v5.17.9",
"v5.17.8",
"v5.17.7.0",
"v5.17.7",
"v5.17.6",
"v5.17.4",
"v5.17.2",
"v5.17.0",
"v5.16.0",
"v5.16.0-RC2",
"v5.16.0-RC1",
"v5.15.9",
"v5.15.5",
"v5.15.4",
"v5.15.3",
"v5.15.2",
"v5.15.1",
"v5.15.0",
"v5.14.0",
"v5.14.0-RC3",
"v5.14.0-RC2",
"v5.14.0-RC1",
"v5.13.11",
"v5.13.10",
"v5.13.9",
"v5.13.8",
"v5.13.7",
"v5.13.6",
"v5.13.5",
"v5.13.4",
"v5.13.3",
"v5.13.2",
"v5.13.1",
"v5.12.0",
"v5.13.0",
"v5.12.0-RC5",
"v5.12.0-RC4",
"v5.12.0-RC3",
"v5.12.0-RC2",
"v5.12.0-RC1",
"v5.12.0-RC0",
"v5.11.5",
"v5.11.4",
"v5.11.3",
"v5.11.1",
"v5.11.0",
"GitLive-blead",
"v5.10.0",
"perl-5.9.5",
"perl-5.9.4",
"perl-5.9.3",
"perl-5.9.2",
"perl-5.9.1",
"perl-5.9.0",
"perl-5.8.0",
"perl-5.7.3",
"perl-5.7.2",
"perl-5.7.1",
"perl-5.7.0",
"perl-5.6.0",
"perl-5.005",
"perl-5.003",
"perl-5.002_01",
"perl-5.002",
"perl-5.001n",
"perl-5.001",
"perl-5.000o",
"perl-5.000",
"perl-5a9",
"perl-5a2",
"perl-4.0.36",
"perl-4.0.00",
"perl-3.044",
"perl-3.000",
"perl-2.0",
"perl-1.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-31486.json"
}
}
],
"modified": "2026-10-28T02:30:22.601664517Z",
"provider": "osv",
"references": [
"https://hackeriet.github.io/cpan-http-tiny-overview/",
"https://www.openwall.com/lists/oss-security/2023/04/18/14",
"https://www.openwall.com/lists/oss-security/2023/05/03/4",
"https://www.reddit.com/r/perl/comments/111tadi/psa_httptiny_disabled_ssl_verification_by_default/",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/31xxx/CVE-2023-31486.json",
"https://nvd.nist.gov/vuln/detail/CVE-2023-31486",
"https://security.netapp.com/advisory/ntap-20241129-0011/",
"https://github.com/chansen/p5-http-tiny/pull/153",
"https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/"
],
"provider_metadata": {
"cna_assigner": "mitre",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/31xxx/CVE-2023-31486.json"
}
},
"related_cves": [
{
"value": "CVE-2023-31486",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 488871,
"published_at": "2023-04-28T00:00:00+00:00"
}