HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-67181 — Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability tha...

·Source: NIST NVD

Updated:

Executive Summary

Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize HTTP message boundaries by exploiting improper header forwarding in the proxy implementation. The proxy in src/proxy.rs forwards the client's Transfer-Encoding header to upstream backends unchanged while transmitting a body already de-chunked by tiny_http, enabling CL.TE desyn

Analysis

Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize HTTP message boundaries by exploiting improper header forwarding in the proxy implementation. The proxy in src/proxy.rs forwards the client's Transfer-Encoding header to upstream backends unchanged while transmitting a body already de-chunked by tiny_http, enabling CL.TE desynchronization attacks where attackers control where the backend believes the request body ends. CVSS Score: 7.2. Published: 2026-07-28T16:20:20.103.

Indicators of Compromise (1)

CVE (1)
CVE-2026-67181
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 28, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Tech jobs go as Visa cuts workforce by 7%

Visa is set to cut around 2600 jobs - seven per cent of its workforce - with technology and product roles taking the brunt of the hit as the payments giant reconfigures its operations for the AI era.

Finextra
LOWVulnerabilityNEW

Ramp enters Canada

Ramp today announced its entry into the Canadian market, making its finance platform available to businesses in Canada. With Ramp, companies can manage spend across currencies in one place, including cards in CAD and USD, CAD bill payments and reimbursements, automated GST, HST, PST, and QST coding, and shared controls, approvals, and accounting workflows.

Finextra
MEDIUMVulnerabilityNEW

Rent payment fintech Flexible Finance applies for bank license

Flexible Finance, Inc. (“Flex”), the financial technology company behind Flex Rent, today announced it has submitted applications to the Federal Deposit Insurance Corporation (“FDIC”) and the Utah Department of Financial Institutions (“UDFI”) to charter Flex Bank, a Utah state-chartered industrial bank.

Finextra