Back to overview

CVE-2026-66746

MEDIUM
5.4
CVSS 3.1
Description
Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return (0x0D) or line feed (0x0A) bytes into attacker-controlled input. Attackers can exploit percent-decoded query parameters reflected into response headers or inject bare LF characters into Cookie header values that are interpolated directly into Set-Cookie response headers, enabling cache poisoning, session fixation, and security header override attacks such as bypassing CSP or CORS policies.

Metadata

CVE ID
CVE-2026-66746
State
PUBLISHED
Assigner
VulnCheck
Reserved
2026-07-27 16:27 UTC
Published
2026-07-28 16:06 UTC
Last updated
2026-07-28 16:06 UTC
Primary CWE
CWE-113
Improper Neutralization of CRLF Sequences in HTTP Headers ('…
Vendor / Product
tomaka / rouille
Sources
cve.org  ·  NVD

Severity & Metrics

5.4 MEDIUM CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Affected products (1)
VendorProductPlatformVersions
tomaka rouille — 0.4.0 ≤ 3.6.2
Weakness (CWE)
CWESourceDescription
CWE-113 cna Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
CVSS scores (2)
ScoreSeverityVersionSourceVector
5.4 MEDIUM 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
5.3 MEDIUM 4.0 cna CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
References (2)
Back to overview