Rouille 0.3.3 through 3.6.2 contains a URL request smuggling vulnerability that enables remote attackers to inject bare line feed characters (0x0A) into header values. The framework forwards the unvalidated header to upstream servers, causing them to interpret the injected content as an entirely separate HTTP request. Because the smuggled request can specify arbitrary methods, paths and headers, it bypasses Rouille’s own access‑control checks, allowing unauthorized actions or data exposure. This weakness is identified as CWE‑444.

Any deployment of the Rouille web framework distributed by Tomaka. The flaw is present in all versions from 0.3.3 up to and including 3.6.2. No other vendors or products are listed in the advisory.

The CVSS score is 6.9, classifying the issue as moderate severity, while the EPSS score is below 1%, indicating a low likelihood of exploitation at the time of analysis. The vulnerability is not included in the CISA KEV catalog. The attack vector is remote over HTTP: an attacker must craft a request containing a line feed in a header that reaches a Rouille instance, at which point the backend interprets the smuggled request as a new one, enabling the attacker to carry out the desired operation.