CVE-2026-66746 describes an HTTP response splitting vulnerability in the tomaka rouille library versions 0.4.0 through 3.6.2. Attackers can inject carriage return (0x0D) or line feed (0x0A) bytes into inputs that are reflected into HTTP response headers without proper sanitization. This includes percent-decoded query parameters and Cookie header values that are directly interpolated into Set-Cookie response headers. The vulnerability enables injection of arbitrary response headers, which can be exploited for cache poisoning, session fixation, and overriding security headers such as Content Security Policy (CSP) or Cross-Origin Resource Sharing (CORS) policies. The CVSS 4.0 base score is 5.3 (medium severity), indicating a network attack vector with low complexity and no privileges required, but requiring user interaction and resulting in low impact on confidentiality and integrity.

Successful exploitation allows remote attackers to inject arbitrary HTTP response headers, leading to cache poisoning, session fixation, and bypass of security headers like CSP and CORS. This can undermine web application security controls and potentially facilitate further attacks. However, the impact is rated medium due to the limited scope of confidentiality and integrity impact and the requirement for user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Users should monitor the vendor's announcements for updates. Until a fix is available, avoid reflecting untrusted input directly into HTTP headers or apply input validation and sanitization to neutralize CRLF characters in user-controlled data used in headers.