Vulnerability · Published Jul 28, 2026 · Assigned by VulnCheck

CVE-2026-67182Rouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Header Injection

High 7.5

In plain English

A high-severity security flaw in rouille from tomaka. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.6%top 49.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to bypass access controls by injecting bare line feed characters (0x0A) into client-supplied request header values that are copied verbatim to upstream connections without validation. Attackers can craft a header value containing a complete additional HTTP request that is interpreted as a separate request by backends such as Go net/http and Python http.server, causing the backend to process a smuggled request with attacker-chosen method, path, and headers that bypasses the rouille handler's access control logic.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:14	rust-rouille	no fix listed	DEBIAN-CVE-2026-67182

Affected products (as reported)

Vendor	Product	Versions
tomaka	rouille	0.3.3 – through 3.6.2

Weakness: CWE-444 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:L

References

Researcher Disclosure technical-description, exploit
https://www.vulncheck.com/advisories/rouille-http-request-smuggling-via-proxy-header-injection third-party-advisory