Description
Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return (0x0D) or line feed (0x0A) bytes into attacker-controlled input. Attackers can exploit percent-decoded query parameters reflected into response headers or inject bare LF characters into Cookie header values that are interpolated directly into Set-Cookie response headers, enabling cache poisoning, session fixation, and security header override attacks such as bypassing CSP or CORS policies.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| tomaka | rouille | 0.4.0 – ≤ 3.6.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rust-rouille | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | sccache | 0.17.0~1-150600.10.14.1 | SUSE-SU-2026:3674-1 |
| SLES 15 SP6 | sccache | 0.17.0~1-150600.10.14.1 | SUSE-SU-2026:3674-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | sccache | 0.18.0~2-160000.1.1 | SUSE-SU-2026:23983-1 |
| SLES for SAP 15 SP6 | sccache | 0.17.0~1-150600.10.14.1 | SUSE-SU-2026:3674-1 |
| SLES 16.0 | sccache | 0.18.0~2-160000.1.1 | SUSE-SU-2026:23983-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | sccache | 0.17.0~1-2.1 | openSUSE-SU-2026:11527-1 |
| openSUSE Leap 16.0 | sccache | 0.18.0~2-160000.1.1 | openSUSE-SU-2026:21982-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
theopaid/CVE-2026-66746-HTTP-Response-Splitting-via-Unvalidated-Response-Header-Values-rouille- ★ 0 · Jul 26, 2026
Security Advisory: HTTP Response Splitting via Unvalidated Response Header Values (rouille)
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 4
- SUSE-SU-2026:23983-1 Security update for sccache SUSE / openSUSE Security Updates · Oct 6, 2026
- openSUSE-SU-2026:21982-1 Security update for sccache SUSE / openSUSE Security Updates · Oct 1, 2026
- SUSE-SU-2026:3674-1 Security update for sccache SUSE / openSUSE Security Updates · Aug 22, 2026
- openSUSE-SU-2026:11527-1 sccache-0.17.0~1-2.1 on GA media SUSE / openSUSE Security Updates · Aug 16, 2026
References
- Researcher Disclosure technical-description exploit
- https://www.vulncheck.com/advisories/rouille-http-response-splitting-via-header-injection third-party-advisory