Back to overview

CVE-2026-67182

HIGH Exploitation: PoC
7.5
CVSS 3.1
Description
Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to bypass access controls by injecting bare line feed characters (0x0A) into client-supplied request header values that are copied verbatim to upstream connections without validation. Attackers can craft a header value containing a complete additional HTTP request that is interpreted as a separate request by backends such as Go net/http and Python http.server, causing the backend to process a smuggled request with attacker-chosen method, path, and headers that bypasses the rouille handler's access control logic.

Metadata

CVE ID
CVE-2026-67182
State
PUBLISHED
Assigner
VulnCheck
Reserved
2026-07-28 16:06 UTC
Published
2026-07-28 16:18 UTC
Last updated
2026-07-28 17:10 UTC
Primary CWE
CWE-444
Inconsistent Interpretation of HTTP Requests ('HTTP Request/…
Vendor / Product
tomaka / rouille
Sources
cve.org  ·  NVD

Severity & Metrics

7.5 HIGH CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:L
SSVC — CISA Coordinator
Exploitation
PoC
Automatable
no
Tech. Impact
partial
Affected products (1)
VendorProductPlatformVersions
tomaka rouille — 0.3.3 ≤ 3.6.2
Weakness (CWE)
CWESourceDescription
CWE-444 cna Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CVSS scores (2)
ScoreSeverityVersionSourceVector
7.5 HIGH 3.1 cna CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:L
6.9 MEDIUM 4.0 cna CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:L/SA:N
References (2)
Back to overview