Vulnerability · Published Jul 28, 2026 · Assigned by VulnCheck

CVE-2026-67181Rouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Transfer-Encoding Header

Medium 5.4

In plain English

A medium-severity security flaw in rouille from tomaka. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.4%top 64.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize HTTP message boundaries by exploiting improper header forwarding in the proxy implementation. The proxy in src/proxy.rs forwards the client's Transfer-Encoding header to upstream backends unchanged while transmitting a body already de-chunked by tiny_http, enabling CL.TE desynchronization attacks where attackers control where the backend believes the request body ends.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:14	rust-rouille	no fix listed	DEBIAN-CVE-2026-67181

Affected products (as reported)

Vendor	Product	Versions
tomaka	rouille	0.3.3 – through 3.6.2

Weakness: CWE-444 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L

References

Researcher Disclosure technical-description, exploit
https://www.vulncheck.com/advisories/rouille-http-request-smuggling-via-proxy-transfer-encoding-header third-party-advisory