CVE-2026-67182

EIP tracks 1 public exploit for CVE-2026-67182. PoCs published by theopaid.

AI-analyzed exploit summary Detailed technical analysis of CVE-2026-67182, an HTTP request smuggling vulnerability in the rouille Rust web framework (versions 0.3.3-3.6.2). The flaw allows attackers to bypass front-end access controls by injecting a bare LF character in HTTP headers, causing the backend to interpret a single request as two separate ones.

Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to bypass access controls by injecting bare line feed characters (0x0A) into client-supplied request header values that are copied verbatim to upstream connections without validation. Attackers can craft a header value containing a complete additional HTTP request that is interpreted as a separate request by backends such as Go net/http and Python http.server, causing the backend to process a smuggled request with attacker-chosen method, path, and headers that bypasses the rouille handler's access control logic.