HIGH

CVE-2026-67182

2026-07-28 CVSS v3.1

CVSS

7.5

Description

Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to bypass access controls by injecting bare line feed characters (0x0A) into client-supplied request header values that are copied verbatim to upstream connections without validation. Attackers can craft a header value containing a complete additional HTTP request that is interpreted as a separate request by backends such as Go net/http and Python http.server, causing the backend to process a smuggled request with attacker-chosen method, path, and headers that bypasses the rouille handler's access control logic.

Weakness (CWE)

CWE-444

EPSS Score

0.42%

Probability of exploitation in next 30 days

35.5th percentile

References

https://github.com/theopaid/HTTP-Request-Smuggling-Enables-Front-End-Access-Control-Bypass-rouille- https://www.vulncheck.com/advisories/rouille-http-request-smuggling-via-proxy-header-injection

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE