CVE-2026-66746: Rouille HTTP Response Splitting XSS Flaw

CVE-2026-66746 Overview

CVE-2026-66746 is an HTTP response splitting vulnerability [CWE-113] affecting the Rouille Rust web micro-framework, versions 0.4.0 through 3.6.2. The flaw allows remote attackers to inject arbitrary response headers by embedding carriage return (0x0D) or line feed (0x0A) bytes into attacker-controlled input. Rouille reflects percent-decoded query parameters into response headers and interpolates Cookie header values directly into Set-Cookie responses without stripping CRLF sequences. Successful exploitation enables cache poisoning, session fixation, and override of security headers such as Content Security Policy (CSP) or Cross-Origin Resource Sharing (CORS).

Critical Impact
Remote attackers can inject malicious response headers to poison caches, fix sessions, and bypass browser security policies including CSP and CORS.

Affected Products

Rouille 0.4.0 through 3.6.2
Rust-based web applications built on the Rouille micro-framework
Downstream services exposing user-controlled query parameters or Cookie values in responses

Discovery Timeline

2026-07-28 - CVE-2026-66746 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-66746

Vulnerability Analysis

Rouille fails to validate or sanitize bytes written into HTTP response header values. The framework accepts attacker-supplied data from two primary sources: percent-decoded query string parameters reflected into headers, and Cookie header values interpolated into outbound Set-Cookie headers. When these values contain CR (\r) or LF (\n) bytes, the HTTP response stream is prematurely terminated and additional headers, or an entirely new response body, can be appended. This class of defect is documented under CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers.

Root Cause

The underlying cause is missing input validation on bytes destined for response header serialization. Rouille trusts decoded input for header emission, so control characters pass through untouched. Because percent-decoding happens before the header is written, attackers can encode %0D%0A in a URL and produce raw CRLF in the final response.

Attack Vector

The vulnerability is exploited over the network with no authentication required. User interaction is typically needed for browser-based attacks such as session fixation or cache poisoning against a victim. An attacker crafts a request whose query parameter or Cookie value contains CRLF sequences followed by attacker-chosen headers or body content. When Rouille echoes that value into a Set-Cookie or reflected header, the injected sequence splits the response, enabling attacker-controlled headers to override or precede legitimate ones.

No verified exploit code has been published in the referenced advisories. See the VulnCheck Security Advisory and the GitHub PoC Repository for exploitation details.

Detection Methods for CVE-2026-66746

Indicators of Compromise

Inbound HTTP requests containing %0D, %0A, \r, or \n sequences in query parameters or Cookie header values
Outbound responses containing unexpected duplicate Set-Cookie, Content-Type, Content-Security-Policy, or Access-Control-Allow-Origin headers
Cache entries serving responses with mismatched or attacker-controlled headers for legitimate URLs

Detection Strategies

Inspect access logs and reverse proxy telemetry for raw or percent-encoded CRLF byte sequences in request URIs and cookie strings
Deploy a Web Application Firewall (WAF) rule that blocks %0[dD]%0[aA] and bare \n bytes in request headers and query parameters
Compare emitted response headers against expected values in staging to identify header duplication or override behavior

Monitoring Recommendations

Forward Rouille application and upstream proxy logs to a centralized data lake for CRLF pattern searches across historical traffic
Alert on anomalous Set-Cookie header counts per response and on responses containing multiple Content-Type values
Monitor cache infrastructure for entries whose stored headers diverge from origin baselines

How to Mitigate CVE-2026-66746

Immediate Actions Required

Inventory all services built on Rouille and identify versions 0.4.0 through 3.6.2 in production and build pipelines
Apply request filtering at the reverse proxy or WAF layer to reject requests containing CR or LF bytes in headers and query parameters
Audit application code paths that reflect user input into response headers, Set-Cookie values, or redirect Location headers

Patch Information

At the time of publication, no fixed Rouille release is identified in the NVD entry. Consult the VulnCheck Security Advisory and the Rouille upstream repository for updates. Until a patched version is available, implement compensating controls at the network edge and within application code.

Workarounds

Strip or reject any request whose decoded query parameters or Cookie values contain \r (0x0D) or \n (0x0A) before invoking Rouille handlers
Avoid reflecting untrusted input directly into response headers; validate against an allowlist of expected characters
Enforce strict cookie parsing that rejects bare LF bytes and disallow multi-line header values in upstream proxies such as NGINX or HAProxy

bash

# Example NGINX pre-filter to drop requests containing encoded CRLF in the query string
if ($request_uri ~* "%0[dD]|%0[aA]") {
    return 400;
}