CVE-2026-67182
Received Received - Intake

HTTP Request Smuggling in Rouille

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: VulnCheck

Description
Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to bypass access controls by injecting bare line feed characters (0x0A) into client-supplied request header values that are copied verbatim to upstream connections without validation. Attackers can craft a header value containing a complete additional HTTP request that is interpreted as a separate request by backends such as Go net/http and Python http.server, causing the backend to process a smuggled request with attacker-chosen method, path, and headers that bypasses the rouille handler's access control logic.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-67182
EUVD
EUVD-2026-49895

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
theopaid rouille From 0.3.3 (inc) to 3.6.2 (inc)
rouille rouille From 0.3.3 (inc) to 3.6.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-444 The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-67182 is an HTTP request smuggling vulnerability in the Rouille library versions 0.3.3 through 3.6.2. It allows remote attackers to bypass access controls by injecting bare line feed characters (0x0A) into request header values. These headers are copied directly to upstream connections without validation, causing backends like Go net/http or Python http.server to interpret the request as two separate ones. The second request, fully controlled by the attacker, bypasses Rouille's access control logic.

Detection Guidance

To detect this vulnerability, monitor for HTTP requests containing bare line feed characters (0x0A) in header values. Use tools like tcpdump or Wireshark to inspect traffic for malformed headers. Check backend logs for requests with unusual paths or methods that bypass access controls. Test with crafted requests containing LF in headers to see if backends interpret them as separate requests.

Impact Analysis

This vulnerability allows unauthorized access to protected resources by bypassing path-based access control, authentication, and request inspection. Attackers can craft requests that split into two, where the second request performs actions with attacker-chosen method, path, and headers. It requires no authentication and works against backends that accept bare LF as line terminators.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Unauthorized access bypassing access controls risks exposing personal or protected health information, potentially resulting in regulatory penalties or breaches of confidentiality.

Mitigation Strategies

Immediately upgrade to a patched version of rouille if available. If no patch exists, implement input validation to reject header values containing control characters like LF (0x0A). Configure backend servers to reject bare LF as line terminators. Use a web application firewall to filter malicious headers. Disable proxy functions in rouille if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67182. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart