A newly discovered flaw in a software application would be considered which kind of security vulnerability?

Input validation flaws describe vulnerabilities caused by insufficient sanitization of user-supplied data, which is a class of vulnerability type, not a descriptor for when a flaw was discovered.

HTTP header injection is a specific technique where unvalidated input is inserted into HTTP response headers, not a general category for newly discovered vulnerabilities.

The term 'zero-day' (0-day) describes a vulnerability that has just been discovered, meaning the vendor has had zero days to develop and release a patch. Because no fix is available, systems remain exposed from the moment of discovery until a patch is issued. This is precisely the scenario described - a newly discovered flaw with no existing remediation.

A time-to-check to time-to-use (TOCTOU) flaw is a race condition vulnerability where resource state changes between a security check and its use, which is unrelated to the recency of discovery.