CVE-2026-66754
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
Rouille versions 0.1.6 through 3.6.2 contain a reachable assertion vulnerability in the Request::remove_prefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL.
Risk Assessment
An attacker can cause a server crash (DoS) without authentication, leading to service disruption and potential loss of availability.
Recommendation
Update the Rouille library to version 3.6.3 or later that fixes this vulnerability, or apply a workaround by validating URLs before processing.
Other vulnerabilities in Rouille
See all- CVE-2026-67182High
Rouille versions 0.3.3 through 3.6.2 have an HTTP request smuggling vulnerability allowing remote attackers to bypass access controls by injecting bare line feed characters (0x0A) into client-supplied header values. These values are copied verbatim to upstream connections without validation. Attackers can craft a header containing an additional HTTP request interpreted as separate by backends (e.g., Go net/http, Python http.server), bypassing Rouille's access control logic.
- CVE-2026-67181Medium
Rouille versions 0.3.3 through 3.6.2 contain an HTTP request smuggling vulnerability. The proxy implementation in src/proxy.rs forwards the client's Transfer-Encoding header to upstream backends unchanged while transmitting a body already de-chunked by tiny_http, enabling CL.TE desynchronization attacks.
- CVE-2026-66746Medium
Rouille versions 0.4.0 through 3.6.2 contain an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return (0x0D) or line feed (0x0A) bytes into attacker-controlled input.
Original NVD description (English source)
Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::remove_prefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL. Attackers can send a request whose decoded path matches a configured prefix while the raw percent-encoded path does not, causing the assert! to fail and triggering either a 500 error or full process termination depending on the panic configuration.