CVE-2026-67182: Tomaka Rouille

High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days.

Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to bypass access controls by injecting bare line feed characters (0x0A) into client-supplied request header values that are copied verbatim to upstream connections without validation. Attackers can craft a header value containing a complete additional HTTP request that is interpreted as a separate request by backends such as Go net/http and Python http.server, causing the backend to process a smuggled request with attacker-chosen method, path, and headers that bypasses the rouille handler's access control logic.

Affected products

• Tomaka Rouille: from 0.3.3, up to and including 3.6.2

Published 2026-07-28. Last modified 2026-07-30.