CVE-2026-67182: Rouille Auth Bypass Vulnerability

CVE-2026-67182 Overview

CVE-2026-67182 is an HTTP request smuggling vulnerability in the Rouille Rust web framework, affecting versions 0.3.3 through 3.6.2. The flaw allows remote attackers to bypass front-end access controls by injecting bare line feed characters (0x0A) into client-supplied HTTP header values. Rouille copies these header values verbatim to upstream connections without validation. Backends such as Go net/http and Python http.server then interpret the smuggled content as a separate HTTP request, executing attacker-chosen methods, paths, and headers outside the reach of Rouille's handler logic. The issue is classified under CWE-444: Inconsistent Interpretation of HTTP Requests.

Critical Impact
Attackers can smuggle arbitrary HTTP requests past Rouille-based access controls, reaching protected backend endpoints without authentication.

Affected Products

Rouille Rust web framework version 0.3.3
Rouille Rust web framework versions up to and including 3.6.2
Applications proxying to backends such as Go net/http or Python http.server

Discovery Timeline

2026-07-28 - CVE-2026-67182 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-67182

Vulnerability Analysis

Rouille acts as a front-end HTTP server or proxy that forwards requests to a downstream backend. When a client submits headers containing bare \n (LF, 0x0A) characters instead of the standard \r\n (CRLF) terminator, Rouille copies the values into the upstream connection unchanged. Standards-compliant parsers require CRLF, but many production HTTP stacks treat a bare LF as a valid header line terminator. This parser disagreement is the root of the smuggling condition.

An attacker crafts a header value that contains an embedded LF followed by a complete second HTTP request. The Rouille layer sees a single request with a large header value. The backend parser sees two distinct requests on the same connection. The second, smuggled request executes with attacker-controlled method, path, headers, and body, bypassing any authentication, path filtering, or method restrictions enforced by the Rouille handler.

Root Cause

The root cause is missing input validation on header values before they are relayed upstream. Rouille does not reject or normalize bare LF characters in client-supplied headers. Because header value sanitization is left to the caller, any application that forwards headers to a downstream HTTP parser inherits the smuggling primitive.

Attack Vector

Exploitation requires network access to the Rouille front-end and a backend that treats bare LF as a header terminator. The attacker sends a single HTTP request whose header value contains 0x0A followed by a fully formed request line, Host header, and optional body. The backend parses the appended content as a second pipelined request. Access controls implemented in Rouille never inspect this smuggled request. See the VulnCheck Security Advisory and the GitHub PoC Repository for full technical detail.

Detection Methods for CVE-2026-67182

Indicators of Compromise

Inbound HTTP requests containing bare 0x0A bytes inside header values, without a preceding 0x0D (CR)
Backend access logs showing requests to restricted paths without a matching Rouille front-end log entry
Unexpected HTTP methods (PUT, DELETE, PATCH) reaching backends that should only receive GET or POST via the proxy
Duplicate or malformed Host headers observed at the backend

Detection Strategies

Inspect raw HTTP byte streams at the network edge for lone LF (0x0A) bytes in header regions
Correlate front-end and back-end access logs; alert when backend request counts exceed proxy request counts on the same connection
Deploy web application firewall rules that reject any header value containing control characters below 0x20 other than the standard CRLF pair

Monitoring Recommendations

Enable full request logging on both Rouille and the upstream backend, including raw header bytes where possible
Monitor for anomalous access patterns to administrative or internal-only endpoints
Track HTTP protocol errors and pipelined request counts per connection as a smuggling signal

How to Mitigate CVE-2026-67182

Immediate Actions Required

Audit all deployments running Rouille versions 0.3.3 through 3.6.2 and identify backend HTTP stacks in the request path
Place a strict HTTP-parsing reverse proxy in front of Rouille that rejects requests containing bare LF in header values
Validate and sanitize any header values before they are forwarded upstream in application code
Review backend logs for evidence of smuggled requests reaching protected endpoints

Patch Information

No fixed version is listed in the NVD entry at the time of publication. Consult the VulnCheck Security Advisory for vendor guidance and any subsequent Rouille release addressing header validation.

Workarounds

Terminate TLS and normalize HTTP at a hardened reverse proxy (for example, one that enforces strict CRLF header parsing) before traffic reaches Rouille
Reject client requests where any header value contains \n, \r, or other control characters at the application layer
Enforce access controls at the backend as well as the front-end, so smuggled requests still encounter authentication checks
Disable HTTP keep-alive and pipelining on the Rouille-to-backend connection where operationally feasible

bash

# Example: block bare LF in header values at an NGINX front-end
# Add to the server block that fronts Rouille
if ($http_user_agent ~ \\x0a) { return 400; }
if ($http_referer   ~ \\x0a) { return 400; }
# For broader coverage, use a WAF ruleset that inspects all header values
# for control characters (0x00-0x1F excluding 0x09) and rejects the request.