CVE-2026-67182 describes an HTTP request smuggling vulnerability in the tomaka rouille HTTP library affecting versions 0.3.3 through 3.6.2. The issue arises because client-supplied request header values containing bare line feed characters (0x0A) are copied verbatim to upstream connections without validation. Attackers can craft headers that embed a complete additional HTTP request, which backend servers like Go net/http and Python http.server interpret as separate requests. This bypasses rouille's access control logic, allowing unauthorized requests to be processed by the backend.

The vulnerability enables remote attackers to bypass access controls by injecting smuggled HTTP requests that the backend processes independently. This can lead to unauthorized access or actions being performed on the backend server, undermining the security controls implemented by rouille. The CVSS 4.0 score of 6.9 reflects a medium severity with network attack vector, low attack complexity, and partial impact on integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, users should consider implementing additional validation or filtering of HTTP headers to prevent injection of bare line feed characters and monitor for unusual request patterns at backend servers.