Skip to content
Heist/ feed
Back to feed
Medium

Rouille 0.4.0 - 3.6.2 HTTP Response Splitting via Header Injection

Type: advisorySources: OSV

Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return (0x0D) or line feed (0x0A) bytes into attacker-controlled input. Attackers can exploit percent-decoded query parameters reflected into response headers or inject bare LF characters into Cookie header values that are interpolated directly into Set-Cookie response headers, enabling cache poisoning, session fixation, and security header override attacks such as bypassing CSP or CORS policies.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-66746
Confirmed fixed CVEs
Not specified
Updated in this feed
5 Nov 2026, 01:50 UTC · Revision 1

Source evidence

Rouille 0.4.0 - 3.6.2 HTTP Response Splitting via Header Injection

core-osv · Original source

Published 28 Jul 2026, 16:06 UTC

Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return (0x0D) or line feed (0x0A) bytes into attacker-controlled input. Attackers can exploit percent-decoded query parameters reflected into response headers or inject bare LF characters into Cookie header values that are interpolated directly into Set-Cookie response headers, enabling cache poisoning, session fixation, and security header override attacks such as bypassing CSP or CORS policies.

osv:CVE-2026-66746
Complete source record
{
  "id": "ef47e0c5a4d46690394a7fa13108dde8ce9a707d4a5e242442dc9a77d0a24b2e",
  "url": "https://osv.dev/vulnerability/CVE-2026-66746",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Rouille 0.4.0 - 3.6.2 HTTP Response Splitting via Header Injection",
    "summary": "Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return (0x0D) or line feed (0x0A) bytes into attacker-controlled input. Attackers can exploit percent-decoded query parameters reflected into response headers or inject bare LF characters into Cookie header values that are interpolated directly into Set-Cookie response headers, enabling cache poisoning, session fixation, and security header override attacks such as bypassing CSP or CORS policies.",
    "evidence": "osv:CVE-2026-66746",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-66746",
      "aliases": [
        "CVE-2026-66746"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/tomaka/rouille",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "last_affected": "536fa0eacaeef93168f3378a0296e3f99da7b3af"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0.4.0"
                      },
                      {
                        "last_affected": "3.6.2"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v3.6.2",
            "v3.6.1",
            "v3.6.0",
            "v3.5.0",
            "v3.4.0",
            "v3.3.1",
            "v3.3.0",
            "v3.2.1",
            "v3.2.0",
            "v3.1.1",
            "v3.1.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-66746.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:41.364489371Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66746.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-66746",
        "https://www.vulncheck.com/advisories/rouille-http-response-splitting-via-header-injection",
        "https://github.com/tomaka/rouille",
        "https://github.com/theopaid/HTTP-Response-Splitting-via-Unvalidated-Response-Header-Values-rouille-"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-113"
        ],
        "cna_assigner": "VulnCheck",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66746.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-66746",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 509167,
  "published_at": "2026-07-28T16:06:18.551+00:00"
}