Hi
I'm filling this with RC level as the upstream project seems
umaintained for now, is this correct? Is rust-rouille a candidate we
should consider for removal for forky?
The following vulnerabilities were published for rust-rouille.
CVE-2026-66746[0]:
| Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting
| vulnerability that allows remote attackers to inject arbitrary
| response headers by embedding carriage return (0x0D) or line feed
| (0x0A) bytes into attacker-controlled input. Attackers can exploit
| percent-decoded query parameters reflected into response headers or
| inject bare LF characters into Cookie header values that are
| interpolated directly into Set-Cookie response headers, enabling
| cache poisoning, session fixation, and security header override
| attacks such as bypassing CSP or CORS policies.
CVE-2026-66754[1]:
| Rouille 0.1.6 through 3.6.2 contains a reachable assertion
| vulnerability in the Request::remove_prefix function that allows
| remote unauthenticated attackers to crash the server by sending a
| crafted percent-encoded URL. Attackers can send a request whose
| decoded path matches a configured prefix while the raw percent-
| encoded path does not, causing the assert! to fail and triggering
| either a 500 error or full process termination depending on the
| panic configuration.
CVE-2026-67181[2]:
| Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling
| vulnerability that allows remote attackers to desynchronize HTTP
| message boundaries by exploiting improper header forwarding in the
| proxy implementation. The proxy in src/proxy.rs forwards the
| client's Transfer-Encoding header to upstream backends unchanged
| while transmitting a body already de-chunked by tiny_http, enabling
| CL.TE desynchronization attacks where attackers control where the
| backend believes the request body ends.
CVE-2026-67182[3]:
| Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling
| vulnerability that allows remote attackers to bypass access controls
| by injecting bare line feed characters (0x0A) into client-supplied
| request header values that are copied verbatim to upstream
| connections without validation. Attackers can craft a header value
| containing a complete additional HTTP request that is interpreted as
| a separate request by backends such as Go net/http and Python
| http.server, causing the backend to process a smuggled request with
| attacker-chosen method, path, and headers that bypasses the rouille
| handler's access control logic.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-66746
https://www.cve.org/CVERecord?id=CVE-2026-66746
[1] https://security-tracker.debian.org/tracker/CVE-2026-66754
https://www.cve.org/CVERecord?id=CVE-2026-66754
[2] https://security-tracker.debian.org/tracker/CVE-2026-67181
https://www.cve.org/CVERecord?id=CVE-2026-67181
[3] https://security-tracker.debian.org/tracker/CVE-2026-67182
https://www.cve.org/CVERecord?id=CVE-2026-67182
Regards,
Salvatore