CVE-2026-66746

Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return (0x0D) or line feed (0x0A) bytes into attacker-controlled input. Attackers can exploit percent-decoded query parameters reflected into response headers or inject bare LF characters into Cookie header values that are interpolated directly into Set-Cookie response headers, enabling cache poisoning, session fixation, and security header override attacks such as bypassing CSP or CORS policies.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/theopaid/HTTP-Response-Splitting-via-Unvalidated-Response-Header-Values-rouille-
https://www.vulncheck.com/advisories/rouille-http-response-splitting-via-header-injection

Configurations

No configuration.

History

24 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Rouille 0.4.0 hasta 3.6.2 contiene una vulnerabilidad de división de respuesta HTTP que permite a atacantes remotos inyectar encabezados de respuesta arbitrarios incrustando bytes de retorno de carro (0x0D) o salto de línea (0x0A) en entradas controladas por el atacante. Los atacantes pueden explotar parámetros de consulta decodificados por porcentaje reflejados en los encabezados de respuesta o inyectar caracteres LF puros en valores de encabezado de cookie que se interpolan directamente en los encabezados de respuesta Set-Cookie, lo que permite el envenenamiento de caché, la fijación de sesión y ataques de anulación de encabezados de seguridad como eludir las políticas CSP o CORS.

Information

Published : 2026-07-28 16:20

Updated : 2026-10-24 13:10

NVD link : CVE-2026-66746

Mitre link : CVE-2026-66746

CVE.ORG link : CVE-2026-66746

JSON object : View

Products Affected

No product.

CWE

CWE-113

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

{"id": "CVE-2026-66746", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-66746", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-29T13:50:09.794006Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/tomaka/rouille", "vendor": "tomaka", "product": "rouille", "versions": [{"status": "affected", "version": "0.4.0", "versionType": "semver", "lessThanOrEqual": "3.6.2"}], "packageURL": "pkg:github/tomaka/rouille", "defaultStatus": "affected"}]}], "published": "2026-07-28T16:20:16.160", "references": [{"url": "https://github.com/theopaid/HTTP-Response-Splitting-via-Unvalidated-Response-Header-Values-rouille-", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/rouille-http-response-splitting-via-header-injection", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-113"}]}], "descriptions": [{"lang": "en", "value": "Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return (0x0D) or line feed (0x0A) bytes into attacker-controlled input. Attackers can exploit percent-decoded query parameters reflected into response headers or inject bare LF characters into Cookie header values that are interpolated directly into Set-Cookie response headers, enabling cache poisoning, session fixation, and security header override attacks such as bypassing CSP or CORS policies."}, {"lang": "es", "value": "Rouille 0.4.0 hasta 3.6.2 contiene una vulnerabilidad de divisi\u00f3n de respuesta HTTP que permite a atacantes remotos inyectar encabezados de respuesta arbitrarios incrustando bytes de retorno de carro (0x0D) o salto de l\u00ednea (0x0A) en entradas controladas por el atacante. Los atacantes pueden explotar par\u00e1metros de consulta decodificados por porcentaje reflejados en los encabezados de respuesta o inyectar caracteres LF puros en valores de encabezado de cookie que se interpolan directamente en los encabezados de respuesta Set-Cookie, lo que permite el envenenamiento de cach\u00e9, la fijaci\u00f3n de sesi\u00f3n y ataques de anulaci\u00f3n de encabezados de seguridad como eludir las pol\u00edticas CSP o CORS."}], "lastModified": "2026-10-24T13:10:00.147", "sourceIdentifier": "disclosure@vulncheck.com"}