HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-66754 — Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the ...

·Source: NIST NVD

Updated:

Executive Summary

Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::remove_prefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL. Attackers can send a request whose decoded path matches a configured prefix while the raw percent-encoded path does not, causing the assert! to fail and triggering either a 500 erro

Analysis

Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::remove_prefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL. Attackers can send a request whose decoded path matches a configured prefix while the raw percent-encoded path does not, causing the assert! to fail and triggering either a 500 error or full process termination depending on the panic configuration. CVSS Score: 7.5. Published: 2026-07-28T16:20:17.267.

Indicators of Compromise (1)

CVE (1)
CVE-2026-66754
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 28, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

House Committee Advances Bill Preventing OSHA From Implementing Heat Standard

A bill that seeks to prohibit the Department of Labor’s Occupational Safety and Health Administration (OSHA) from issuing a standard […] The post House Committee Advances Bill Preventing OSHA From Implementing Heat Standard appeared first on The HIPAA Journal .

HIPAA Journal
HIGHVulnerability

NVD HIGH: CVE-2026-67181 — Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability tha...

Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize HTTP message boundaries by exploiting improper header forwarding in the proxy implementation. The proxy in src/proxy.rs forwards the client's Transfer-Encoding header to upstream backends unchanged while transmitting a body already de-chunked by tiny_http, enabling CL.TE desyn

CVE-2026-67181
NIST NVD
HIGHVulnerability

NVD HIGH: CVE-2026-66752 — tiny-http through 0.12.0 contains an HTTP request smuggling vulnerability that a...

tiny-http through 0.12.0 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize request framing by sending a Transfer-Encoding header with any value, including non-chunked codings, which causes the library to unconditionally apply chunk-decoding and discard Content-Length. Attackers can exploit the discrepancy between tiny_http's improper Transfer-Encoding p

CVE-2026-66752
NIST NVD