HTTP Response Splitting Vulnerability in Rouille by Theopaid
CVE-2026-66746

5.3MEDIUM

Key Information:

Vendor

Tomaka

Status
Rouille
Vendor
CVE Published:
28 July 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-66746?

Rouille, a web framework by Theopaid, is susceptible to an HTTP response splitting vulnerability that affects versions 0.4.0 through 3.6.2. This security issue arises when attackers embed carriage return (0x0D) or line feed (0x0A) bytes into user-controlled inputs. Such manipulation can allow the injection of arbitrary response headers, especially through reflected percent-decoded query parameters or direct injection into Cookie header values. As a result, attackers may exploit this flaw to poison caches, fixate sessions, or bypass critical security mechanisms like Content Security Policy (CSP) and Cross-Origin Resource Sharing (CORS), significantly compromising the integrity and safety of web applications.

Affected Version(s)

rouille 0.4.0 <= 3.6.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-66746 - Proof of Concept

References

https://github.com/theopaid/HTTP-Response-Splitting-via-U...
technical-descriptionexploit
https://www.vulncheck.com/advisories/rouille-http-respons...
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Theodosis Paidakis
.