HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-67182 — Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability tha...

·Source: NIST NVD

Updated:

Executive Summary

Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to bypass access controls by injecting bare line feed characters (0x0A) into client-supplied request header values that are copied verbatim to upstream connections without validation. Attackers can craft a header value containing a complete additional HTTP request that is interpreted as a sepa

Analysis

Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to bypass access controls by injecting bare line feed characters (0x0A) into client-supplied request header values that are copied verbatim to upstream connections without validation. Attackers can craft a header value containing a complete additional HTTP request that is interpreted as a separate request by backends such as Go net/http and Python http.server, causing the backend to process a smuggled request with attacker-chosen method, path, and headers that bypasses the rouille handler's access control logic. CVSS Score: 7.5. Published: 2026-07-28T17:17:07.587.

Indicators of Compromise (1)

CVE (1)
CVE-2026-67182
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 28, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Mastercard strengthens Asia Pacific leadership team

Mastercard today announced that Joyce Bo has joined the company as Executive Vice President, Core Payments, Asia Pacific.

Finextra
MEDIUMVulnerabilityNEW

AutoRek acquires Grath

AutoRek, the leader in enterprise financial controls and reconciliation automation, today announced the acquisition of Grath, an innovative fintech recognised for its AI-driven approach to reconciliation and compliance challenges in financial services.

Finextra
MEDIUMVulnerabilityNEW

Ripple invests in UK digital assets platform Licuido

Capital markets tokenization platform Licuido has secured a strategic investment from Ripple to scale its operations and support the development of digital capital markets infrastructure on the XRP Ledger (XRPL).

Finextra