CVE-2026-66746 Details

An HTTP response splitting vulnerability has been identified in Rouille versions 0.4.0 through 3.6.2. This vulnerability allows remote attackers to inject arbitrary response headers by embedding carriage return or line feed bytes into attacker-controlled input. The issue arises because the application does not validate header values before sending them in the response. Attackers can exploit percent-decoded query parameters that are reflected into response headers or inject bare line feed characters into Cookie header values. This unvalidated input is then directly interpolated into Set-Cookie response headers, leading to potential cache poisoning, session fixation, and the ability to override security headers such as Content Security Policy or Cross-Origin Resource Sharing policies.

Header values should be validated in the Server::process function before they are passed to tiny_http. Additionally, the session key validation in the session::session function should be improved to reject invalid cookie values and generate new session IDs.