CVE-2026-67182

Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to bypass access controls by injecting bare line feed characters (0x0A) into client-supplied request header values that are copied verbatim to upstream connections without validation. Attackers can craft a header value containing a complete additional HTTP request that is interpreted as a separate request by backends such as Go net/http and Python http.server, causing the backend to process a smuggled request with attacker-chosen method, path, and headers that bypasses the rouille handler's access control logic.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://github.com/theopaid/HTTP-Request-Smuggling-Enables-Front-End-Access-Control-Bypass-rouille-
https://www.vulncheck.com/advisories/rouille-http-request-smuggling-via-proxy-header-injection

Configurations

No configuration.

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Rouille 0.3.3 hasta 3.6.2 contiene una vulnerabilidad de contrabando de solicitudes HTTP que permite a atacantes remotos eludir los controles de acceso mediante la inyección de caracteres de salto de línea puros (0x0A) en valores de encabezado de solicitud proporcionados por el cliente que se copian textualmente a las conexiones ascendentes sin validación. Los atacantes pueden elaborar un valor de encabezado que contenga una solicitud HTTP adicional completa que es interpretada como una solicitud separada por backends como Go net/http y Python http.server, haciendo que el backend procese una solicitud contrabandeada con método, ruta y encabezados elegidos por el atacante que elude la lógica de control de acceso del gestor de rouille.

Information

Published : 2026-07-28 17:17

Updated : 2026-10-23 23:10

NVD link : CVE-2026-67182

Mitre link : CVE-2026-67182

CVE.ORG link : CVE-2026-67182

JSON object : View

Products Affected

No product.

CWE

CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

{"id": "CVE-2026-67182", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-67182", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-28T17:08:25.201305Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.7, "exploitabilityScore": 2.2}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/tomaka/rouille", "vendor": "tomaka", "product": "rouille", "versions": [{"status": "affected", "version": "0.3.3", "versionType": "semver", "lessThanOrEqual": "3.6.2"}], "packageURL": "pkg:github/tomaka/rouille", "defaultStatus": "affected"}]}], "published": "2026-07-28T17:17:07.587", "references": [{"url": "https://github.com/theopaid/HTTP-Request-Smuggling-Enables-Front-End-Access-Control-Bypass-rouille-", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/rouille-http-request-smuggling-via-proxy-header-injection", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-444"}]}], "descriptions": [{"lang": "en", "value": "Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to bypass access controls by injecting bare line feed characters (0x0A) into client-supplied request header values that are copied verbatim to upstream connections without validation. Attackers can craft a header value containing a complete additional HTTP request that is interpreted as a separate request by backends such as Go net/http and Python http.server, causing the backend to process a smuggled request with attacker-chosen method, path, and headers that bypasses the rouille handler's access control logic."}, {"lang": "es", "value": "Rouille 0.3.3 hasta 3.6.2 contiene una vulnerabilidad de contrabando de solicitudes HTTP que permite a atacantes remotos eludir los controles de acceso mediante la inyecci\u00f3n de caracteres de salto de l\u00ednea puros (0x0A) en valores de encabezado de solicitud proporcionados por el cliente que se copian textualmente a las conexiones ascendentes sin validaci\u00f3n. Los atacantes pueden elaborar un valor de encabezado que contenga una solicitud HTTP adicional completa que es interpretada como una solicitud separada por backends como Go net/http y Python http.server, haciendo que el backend procese una solicitud contrabandeada con m\u00e9todo, ruta y encabezados elegidos por el atacante que elude la l\u00f3gica de control de acceso del gestor de rouille."}], "lastModified": "2026-10-23T23:10:00.157", "sourceIdentifier": "disclosure@vulncheck.com"}