CVE-2026-67182
Rouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Header Injection
- State
- Published
- Severity
- 6.9 Medium
- Published
- Jul 28, 2026
- Updated
- Jul 28, 2026
- Reserved
- Jul 28, 2026
Description
Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to bypass access controls by injecting bare line feed characters (0x0A) into client-supplied request header values that are copied verbatim to upstream connections without validation. Attackers can craft a header value containing a complete additional HTTP request that is interpreted as a separate request by backends such as Go net/http and Python http.server, causing the backend to process a smuggled request with attacker-chosen method, path, and headers that bypasses the rouille handler's access control logic.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:L/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:L | VulnCheck |
Weaknesses
- CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected Products
| Product | Versions |
|---|---|
rouilletomaka |
|
References
- Researcher Disclosuretechnical-descriptionexploit
- https://www.vulncheck.com/advisories/rouille-http-request-smuggling-via-proxy-header-injectionthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.