CVE-2026-67182
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
Rouille versions 0.3.3 through 3.6.2 have an HTTP request smuggling vulnerability allowing remote attackers to bypass access controls by injecting bare line feed characters (0x0A) into client-supplied header values. These values are copied verbatim to upstream connections without validation. Attackers can craft a header containing an additional HTTP request interpreted as separate by backends (e.g., Go net/http, Python http.server), bypassing Rouille's access control logic.
Risk Assessment
An attacker can bypass access controls and perform unauthorized operations on the backend, leading to integrity and confidentiality breaches and enabling further attacks.
Recommendation
Upgrade Rouille to a version above 3.6.2 that includes validation and sanitization of header values before forwarding to the backend.
Other vulnerabilities in Rouille
See all- CVE-2026-67181Medium
Rouille versions 0.3.3 through 3.6.2 contain an HTTP request smuggling vulnerability. The proxy implementation in src/proxy.rs forwards the client's Transfer-Encoding header to upstream backends unchanged while transmitting a body already de-chunked by tiny_http, enabling CL.TE desynchronization attacks.
- CVE-2026-66754Medium
Rouille versions 0.1.6 through 3.6.2 contain a reachable assertion vulnerability in the Request::remove_prefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL.
- CVE-2026-66746Medium
Rouille versions 0.4.0 through 3.6.2 contain an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return (0x0D) or line feed (0x0A) bytes into attacker-controlled input.
Original NVD description (English source)
Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to bypass access controls by injecting bare line feed characters (0x0A) into client-supplied request header values that are copied verbatim to upstream connections without validation. Attackers can craft a header value containing a complete additional HTTP request that is interpreted as a separate request by backends such as Go net/http and Python http.server, causing the backend to process a smuggled request with attacker-chosen method, path, and headers that bypasses the rouille handler's access control logic.