CVE-2026-67182

HTTP request smuggling in Rouille via line feed injection bypasses controls.

• CVSS 6.9
• 444
• Input Validation and Sanitization
• Remote

Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to bypass access controls by injecting bare line feed characters (0x0A) into client-supplied request header values that are copied verbatim to upstream connections without validation. Attackers can craft a header value containing a complete additional HTTP request that is interpreted as a separate request by backends such as Go net/http and Python http.server, causing the backend to process a smuggled request with attacker-chosen method, path, and headers that bypasses the rouille handler's access control logic.

CVE

CVE-2026-67182

CWE

444

CVSS base score

6.9

Published

2026-07-28

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Unauthorized Access

Affected component

Rouille

Fixed by upgrading

Yes

Solution

Upgrade to Rouille version 3.7.0 or later.

import urllib.request
from typing import Dict

def forward_request_to_backend(client_environ: Dict, backend_url: str):
    """
    A simplified reverse proxy that rebuilds a request for a backend service.
    This simulates reading headers from a WSGI-like environment.
    """
    upstream_headers = {}
    for key, value in client_environ.items():
        if key.startswith("HTTP_"):
            header_name = key[5:].replace("_", "-").title()
            # VULNERABLE: The header value is copied verbatim, allowing embedded newline characters.
            upstream_headers[header_name] = value

    # The request is built with potentially malicious headers.
    # A backend server could misinterpret this as two separate requests,
    # bypassing frontend access controls (HTTP Request Smuggling).
    request = urllib.request.Request(backend_url, headers=upstream_headers)

    # In a real application, this request would be sent to the backend,
    # for example, via `urllib.request.urlopen(request)`.
    return request

import urllib.request
from typing import Dict

def forward_request_to_backend(client_environ: Dict, backend_url: str):
    """
    A simplified reverse proxy that rebuilds a request for a backend service.
    This simulates reading headers from a WSGI-like environment.
    """
    upstream_headers = {}
    for key, value in client_environ.items():
        if key.startswith("HTTP_"):
            header_name = key[5:].replace("_", "-").title()
            # FIX: The header value is sanitized by taking only the first line.
            safe_value = str(value).splitlines()[0] if value else ""
            upstream_headers[header_name] = safe_value

    # The request is built with sanitized headers, preventing request smuggling.
    request = urllib.request.Request(backend_url, headers=upstream_headers)

    # In a real application, this request would be sent to the backend,
    # for example, via `urllib.request.urlopen(request)`.
    return request

GET /public-resource HTTP/1.1
Host: vulnerable-app.com
X-Custom-Header: ignored\nGET /admin HTTP/1.1\nHost: vulnerable-app.com\nBypass: True

Content-Length: 0

@misc{vaitp:cve202667182,
  title        = {{HTTP request smuggling in Rouille via line feed injection bypasses controls.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-67182},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-67182/}}
}