Attack Chain

1. An attacker sends a specially crafted HTTP request to a vulnerable Rouille proxy server.
2. The crafted request includes a Transfer-Encoding: chunked header and a Content-Length header, designed to create ambiguity for the backend.
3. The Rouille proxy, using tiny_http, processes and de-chunks the request body received from the client.
4. The proxy then forwards the request to an upstream backend, but critically, it forwards the client's original Transfer-Encoding: chunked header unchanged.
5. This creates a desynchronization: the proxy interprets the request body based on the de-chunked content, while the upstream backend attempts to interpret the request based on the forwarded Transfer-Encoding: chunked header.
6. By carefully crafting subsequent requests and controlling chunk sizes, the attacker can cause the backend to interpret the end of one request differently than the proxy, allowing parts of the attacker's next request to be prepended to legitimate users' requests.
7. This technique can be used to inject malicious content into cache entries, bypass security appliances, or gain unauthorized access to internal application logic.

Impact

Successful exploitation of CVE-2026-67181 can lead to various severe consequences for organizations utilizing affected Rouille proxy implementations. The primary impact involves the bypassing of security controls, including web application firewalls (WAFs) and intrusion prevention systems, as the smuggled requests may not be properly inspected. Attackers could also achieve cache poisoning, leading to the serving of malicious or manipulated content to legitimate users. In some scenarios, request smuggling can facilitate unauthorized access to sensitive internal resources or administrative interfaces, potentially escalating to remote code execution (RCE) on the backend servers if further vulnerabilities are chained. While specific victim counts are not available, any organization deploying Rouille as an HTTP proxy in versions 0.3.3 through 3.6.2 is at risk.

Recommendation

• Patch CVE-2026-67181 on all Rouille HTTP server deployments to version 3.6.3 or newer immediately.
• Deploy the provided Sigma rule to your SIEM to detect suspicious HTTP request headers indicative of request smuggling attempts.
• Monitor webserver logs for HTTP requests containing conflicting Content-Length and Transfer-Encoding headers, as these are common indicators of request smuggling.