CVE-2026-67182 Details
Description
Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to bypass access controls by injecting bare line feed characters (0x0A) into client-supplied request header values that are copied verbatim to upstream connections without validation. Attackers can craft a header value containing a complete additional HTTP request that is interpreted as a separate request by backends such as Go net/http and Python http.server, causing the backend to process a smuggled request with attacker-chosen method, path, and headers that bypasses the rouille handler's access control logic.
An HTTP request smuggling vulnerability has been identified in Rouille versions 0.3.3 through 3.6.2. This vulnerability allows remote attackers to bypass access controls by injecting bare line feed characters into request header values. These unvalidated headers are then sent upstream, where the injected line feeds can create a separate, smuggled HTTP request. This smuggled request can bypass the access control logic of the Rouille handler, potentially leading to unauthorized access to protected resources.
To address this vulnerability, header names and values should be validated to reject any control characters before they are sent upstream. This can be implemented by checking for bytes that are outside the range of printable ASCII characters, as well as rejecting bare line feeds and carriage returns.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 28, 2026CISA-ADP
Assessed Jul 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-444 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Rouille | >= 0.3.3, <= 3.6.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 28, 2026 | CVE Modified | CISA-ADP |
| Jul 28, 2026 | New CVE Received | [email protected] |