CVE-2026-66746

Name of the Vulnerable Software and Affected Versions Rouille versions 0.4.0 through 3.6.2

Description An HTTP response splitting issue exists where remote attackers can inject arbitrary response headers by embedding carriage return (0x0D) or line feed (0x0A) bytes into input they control. This can occur through percent-decoded query parameters reflected in response headers or by injecting line feed characters into Cookie header values that are interpolated directly into Set-Cookie response headers. Such actions can lead to cache poisoning, session fixation, and the override of security headers, which may allow attackers to bypass Content Security Policy (CSP) or Cross-Origin Resource Sharing (CORS) policies.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.