Rouille versions 0.4.0 through 3.6.2 contain an HTTP response splitting flaw that allows remote attackers to inject carriage return or line feed bytes into response headers by embedding percent‑decoded query parameters or cookie values that are reflected directly into Set‑Cookie and other headers. This injection can overwrite or add response headers, leading to cache poisoning, session fixation, and the ability to override protection headers such as Content‑Security‑Policy or Cross‑Origin‑Resource‑Sharing.

The vulnerability affects the tomaka:rouille HTTP framework from versions 0.4.0 up to 3.6.2.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote HTTP requests that include percent‑decoded data or cookie headers containing unfiltered CR or LF characters, which an attacker can exploit to modify response headers.