CVE-2026-66746
Received Received - Intake

HTTP Response Splitting in Rouille

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: VulnCheck

Description
Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return (0x0D) or line feed (0x0A) bytes into attacker-controlled input. Attackers can exploit percent-decoded query parameters reflected into response headers or inject bare LF characters into Cookie header values that are interpolated directly into Set-Cookie response headers, enabling cache poisoning, session fixation, and security header override attacks such as bypassing CSP or CORS policies.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-66746
EUVD
EUVD-2026-49889

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
rouille rouille From 0.4.0 (inc) to 3.6.2 (inc)
theopaid rouille From 0.4.0 (inc) to 3.6.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-113 The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-66746 is an HTTP response splitting vulnerability in the Rust web framework rouille versions 0.4.0 through 3.6.2. It allows attackers to inject arbitrary response headers by inserting carriage return (0x0D) or line feed (0x0A) characters into user-controlled input. This occurs because rouille does not sanitize these characters in header values, enabling CRLF injection attacks through malicious query parameters or malformed cookies.

Detection Guidance

To detect this vulnerability, inspect HTTP responses for injected CRLF sequences in headers. Check for unusual response headers, redirects, or multiple responses from a single request. Use tools like curl to send crafted requests with %0d%0a in query parameters or LF characters in cookies and observe responses for header splitting or anomalies.

Impact Analysis

This vulnerability can lead to cache poisoning, session fixation, and security header overrides such as bypassing CSP or CORS policies. Attackers can execute scripts in the origin's security context, manipulate cached content, or hijack user sessions by injecting malicious headers.

Compliance Impact

This vulnerability could lead to security header overrides, such as bypassing CSP or CORS policies, which may weaken data protection measures required by GDPR and HIPAA. Session fixation and cache poisoning risks could also compromise data integrity and confidentiality, potentially violating compliance requirements for secure data handling and transmission.

Mitigation Strategies

Immediately upgrade to a patched version of rouille beyond 3.6.2. If upgrading is not possible, validate all header values and session keys to reject CR, LF, and null bytes. Ensure session keys only contain alphanumeric characters. Return 500 errors for invalid headers to prevent silent failures.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66746. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart