CVE-2026-66746

🗓️ 28 Jul 2026 16:06:18Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 30 Views🌐 WEB

Rouille HTTP response splitting via input that injects headers enabling cache poisoning, session fixation.

Reporter	Title	Published	Views	Family All 13
ATTACKERKB	CVE-2026-66746	28 Jul 202616:06	–	attackerkb
Cvelist	CVE-2026-66746 Rouille 0.4.0 - 3.6.2 HTTP Response Splitting via Header Injection	28 Jul 202616:06	–	cvelist
Debian CVE	CVE-2026-66746	28 Jul 202616:06	–	debiancve
EUVD	EUVD-2026-49889	28 Jul 202616:06	–	euvd
NVD	CVE-2026-66746	28 Jul 202616:20	–	nvd
OPENSUSE Linux	sccache-0.17.0~1-2.1 on GA media (moderate)	17 Aug 202600:00	–	opensuse
OSV	DEBIAN-CVE-2026-66746	28 Jul 202616:20	–	osv
OSV	OPENSUSE-SU-2026:11527-1 sccache-0.17.0~1-2.1 on GA media	15 Aug 202600:00	–	osv
Packet Storm	📄 rouille 3.6.2 HTTP Response Splitting	29 Jul 202600:00	–	packetstorm
Positive Technologies	PT-2026-65517	28 Jul 202600:00	–	ptsecurity

Vulners

Node

tomaka rouilleRange0.4.0–3.6.2

[
  {
    "defaultStatus": "affected",
    "vendor": "tomaka",
    "product": "rouille",
    "packageURL": "pkg:github/tomaka/rouille",
    "repo": "https://github.com/tomaka/rouille",
    "versions": [
      {
        "status": "affected",
        "version": "0.4.0",
        "versionType": "semver",
        "lessThanOrEqual": "3.6.2"
      }
    ]
  }
]

Source	Link
github	www.github.com/theopaid/HTTP-Response-Splitting-via-Unvalidated-Response-Header-Values-rouille-
vulncheck	www.vulncheck.com/advisories/rouille-http-response-splitting-via-header-injection

Parameter	Position	Path	Description	CWE
next	query param	/?next=%2F%0d%0aX-Injected:%20yes	CRLF injection via percent-decoded query parameter reflected into response header (Path A).	CWE-113
Cookie	header	/	Set-Cookie header value is derived from client cookie without validation (Path B).	CWE-113

30 Jul 2026 16:41Current

6Medium risk

Vulners AI Score6

CVSS 45.3

CVSS 3.15.4

EPSS0.00241

SSVC

CWE-113