CVE-2026-66746

The record

Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return (0x0D) or line feed (0x0A) bytes into attacker-controlled input. Attackers can exploit percent-decoded query parameters reflected into response headers or inject bare LF characters into Cookie header values that are interpolated directly into Set-Cookie response headers, enabling cache poisoning, session fixation, and security header override attacks such as bypassing CSP or CORS policies.

Affected packages

Related vulnerabilities

• CVE-2026-55486 The Goobi viewer is a web application that allows digitised material to be displayed in a… CWE-113
• CVE-2026-2811 The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection… CWE-113
• CVE-2026-77341 cpp-httplib is a C++ header-only HTTP/HTTPS library. CWE-113
• CVE-2026-75419 go-wind-cms (GoWind) before 1.0.0 has a missing authorization vulnerability. CWE-113
• CVE-2026-50576 ePA 3.x Integration implements the authorization workflow and writes Medical Information… CWE-113
• CVE-2026-63771 Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to… CWE-113
• CVE-2026-54163 secure_headers manages application of security headers with many safe defaults. CWE-113
• CVE-2026-50188 Kirby is an open-source content management system. CWE-113