CVE-2026-66746
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Rouille versions 0.4.0 through 3.6.2 contain an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return (0x0D) or line feed (0x0A) bytes into attacker-controlled input.
Risk Assessment
An attacker can exploit this vulnerability for cache poisoning, session fixation, or bypassing security policies such as CSP or CORS, leading to integrity and confidentiality breaches.
Recommendation
Update the Rouille library to version 3.6.3 or later that fixes this vulnerability, or apply a workaround by sanitizing input before using it in response headers.
Other vulnerabilities in Rouille
See all- CVE-2026-67182High
Rouille versions 0.3.3 through 3.6.2 have an HTTP request smuggling vulnerability allowing remote attackers to bypass access controls by injecting bare line feed characters (0x0A) into client-supplied header values. These values are copied verbatim to upstream connections without validation. Attackers can craft a header containing an additional HTTP request interpreted as separate by backends (e.g., Go net/http, Python http.server), bypassing Rouille's access control logic.
- CVE-2026-67181Medium
Rouille versions 0.3.3 through 3.6.2 contain an HTTP request smuggling vulnerability. The proxy implementation in src/proxy.rs forwards the client's Transfer-Encoding header to upstream backends unchanged while transmitting a body already de-chunked by tiny_http, enabling CL.TE desynchronization attacks.
- CVE-2026-66754Medium
Rouille versions 0.1.6 through 3.6.2 contain a reachable assertion vulnerability in the Request::remove_prefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL.
Original NVD description (English source)
Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return (0x0D) or line feed (0x0A) bytes into attacker-controlled input. Attackers can exploit percent-decoded query parameters reflected into response headers or inject bare LF characters into Cookie header values that are interpolated directly into Set-Cookie response headers, enabling cache poisoning, session fixation, and security header override attacks such as bypassing CSP or CORS policies.