CVE-2026-66746 in rouille
Summary
by MITRE • 07/28/2026
Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return (0x0D) or line feed (0x0A) bytes into attacker-controlled input. Attackers can exploit percent-decoded query parameters reflected into response headers or inject bare LF characters into Cookie header values that are interpolated directly into Set-Cookie response headers, enabling cache poisoning, session fixation, and security header override attacks such as bypassing CSP or CORS policies.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/28/2026
The Rouille web framework version 0.4.0 through 3.6.2 contains a critical HTTP response splitting vulnerability that stems from inadequate input validation and sanitization of user-controlled data within HTTP response headers. This vulnerability manifests when the framework fails to properly escape or filter carriage return and line feed characters, creating opportunities for attackers to inject malicious content into HTTP responses. The flaw specifically occurs in how the framework handles percent-decoded query parameters that are reflected back into response headers, as well as direct interpolation of cookie values into Set-Cookie headers without proper sanitization. This vulnerability directly maps to CWE-113, which addresses improper neutralization of characters or elements within HTTP headers, and represents a significant security weakness in the framework's input handling mechanisms.
The technical exploitation of this vulnerability enables attackers to perform sophisticated header injection attacks by embedding 0x0D (carriage return) and 0x0A (line feed) bytes into attacker-controlled inputs. When these characters are processed within HTTP response headers, they allow malicious actors to split the original HTTP response into multiple responses, creating opportunities for cache poisoning attacks where malicious content can be cached and served to other users. The vulnerability is particularly dangerous because it can be exploited through query parameters that are percent-decoded and then reflected back into HTTP headers, or by injecting bare line feed characters directly into cookie values that are interpolated into Set-Cookie headers. This dual exploitation vector increases the attack surface significantly.
The operational impact of this vulnerability extends beyond simple header injection to enable more sophisticated attacks including session fixation, cache poisoning, and bypassing critical security policies such as Content Security Policy (CSP) and Cross-Origin Resource Sharing (CORS). Attackers can manipulate security headers by injecting malicious content that overrides legitimate security configurations, potentially allowing them to execute cross-site scripting attacks or gain unauthorized access to user sessions. The vulnerability particularly undermines the integrity of HTTP responses by enabling attackers to inject arbitrary response headers that can be interpreted by browsers and intermediaries differently than intended. This creates a pathway for man-in-the-middle attacks, where malicious actors can manipulate web application behavior and potentially steal sensitive user information or credentials.
Organizations using affected versions of Rouille should immediately implement mitigations including input validation and sanitization of all user-controlled data before it is processed into HTTP headers, proper escaping of special characters including carriage return and line feed sequences, and implementation of strict header validation mechanisms. The recommended approach involves filtering or encoding any input that will be used in HTTP response headers to ensure that 0x0D and 0x0A characters cannot be injected. Additionally, organizations should consider implementing automated security scanning tools that can detect similar vulnerabilities in their web applications and establish proper monitoring for suspicious header injection attempts. This vulnerability aligns with ATT&CK technique T1566 which covers credential access through phishing or manipulation of HTTP responses, making it particularly dangerous in environments where user authentication and session management are critical components of the security architecture.