CVE-2026-67182

Name of the Vulnerable Software and Affected Versions Rouille versions 0.3.3 through 3.6.2

Description An HTTP request smuggling issue exists where remote attackers can bypass access controls by injecting bare line feed characters (0x0A) into client-supplied request header values. These values are copied verbatim to upstream connections without validation. This allows an attacker to craft a header value containing a complete additional HTTP request that backends, such as Go net/http and Python http.server, interpret as a separate request. Consequently, the backend processes a smuggled request with an attacker-chosen method, path, and headers, bypassing the access control logic of the rouille handler.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.