CVE-2026-66746

EIP tracks 1 public exploit for CVE-2026-66746. PoCs published by theopaid.

AI-analyzed exploit summary This repository provides a detailed technical analysis of CVE-2026-66746, an HTTP response splitting vulnerability in the rouille Rust web framework. The vulnerability arises from unvalidated CRLF sequences in response header values, enabling attackers to inject arbitrary headers or entire HTTP responses. The writeup includes root cause analysis, patch diffs, and functional proof-of-concept code demonstrating both exploitation paths.

Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return (0x0D) or line feed (0x0A) bytes into attacker-controlled input. Attackers can exploit percent-decoded query parameters reflected into response headers or inject bare LF characters into Cookie header values that are interpolated directly into Set-Cookie response headers, enabling cache poisoning, session fixation, and security header override attacks such as bypassing CSP or CORS policies.