CVE-2026-66754 in rouille
Summary
by MITRE • 07/28/2026
Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::remove_prefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL. Attackers can send a request whose decoded path matches a configured prefix while the raw percent-encoded path does not, causing the assert! to fail and triggering either a 500 error or full process termination depending on the panic configuration.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/28/2026
The vulnerability under discussion affects the Rouille web framework version range from 0.1.6 through 3.6.2, specifically within the Request::remove_prefix function where a reachable assertion failure exists. This represents a denial of service condition that can be exploited by remote unauthenticated attackers without requiring any authentication credentials or privileges to execute the attack successfully.
The technical flaw manifests when an attacker crafts a specially formatted percent-encoded URL that creates a discrepancy between the decoded path and the raw percent-encoded path. The Request::remove_prefix function performs assertions to validate prefix matching, but fails to properly handle cases where the encoded version of a path does not align with the expected prefix pattern during decoding. When such a malformed request is processed, the assert! macro triggers a failure that results in either a 500 internal server error or complete process termination depending on how the panic behavior has been configured.
This vulnerability directly relates to CWE-617, which describes reachable assertions, and represents a classic example of improper input validation where the framework fails to account for the complexities introduced by URL encoding. The operational impact extends beyond simple service disruption as it can potentially be leveraged in larger attack campaigns where attackers might use this condition to probe server configurations or to identify vulnerable systems within a network infrastructure. The vulnerability affects any system running affected versions of Rouille, making it particularly concerning for web applications that rely on this framework for handling HTTP requests.
The attack vector requires only a simple HTTP request with crafted percent-encoded parameters, making exploitation straightforward and accessible to attackers with minimal technical expertise. This characteristic places the vulnerability in the ATT&CK framework category of "Command and Control" under techniques involving network service scanning or reconnaissance activities where attackers might attempt to identify system weaknesses through controlled requests that trigger specific failure conditions.
Mitigation strategies should include immediate upgrade to versions of Rouille that have patched this assertion failure, typically those beyond version 3.6.2. Organizations should also implement robust input validation at the application level and consider deploying web application firewalls that can detect and block suspicious URL patterns. Additional defensive measures might involve configuring panic handling to prevent process termination during assertion failures and implementing comprehensive logging to monitor for exploitation attempts. The vulnerability demonstrates the importance of thorough testing of edge cases in HTTP request processing, particularly when dealing with URL encoding and decoding operations that can introduce unexpected behavior in framework components. Security teams should also consider implementing automated monitoring solutions that can detect service disruptions or process terminations that might indicate exploitation attempts against this type of vulnerability.