Rouille - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/rouille/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 28 Jul 2026 16:22:53 +0000Rouille Web Server Vulnerability CVE-2026-66754 Allows Remote DoShttps://feed.craftedsignal.io/briefs/2026-07-rouille-dos-cve-2026-66754/Tue, 28 Jul 2026 16:22:53 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-rouille-dos-cve-2026-66754/A reachable assertion vulnerability exists in the `Request::remove_prefix` function of the Rouille web server framework, affecting versions 0.1.6 through 3.6.2, allowing remote, unauthenticated attackers to crash the server and cause a denial of service by sending a crafted percent-encoded URL.CVE-2026-66754 is a reachable assertion vulnerability identified in the Rouille web server framework, specifically within the Request::remove_prefix function. This flaw affects Rouille versions 0.1.6 through 3.6.2. Remote and unauthenticated attackers can exploit this vulnerability by sending a specially crafted percent-encoded URL to a vulnerable server. The attack relies on a discrepancy where the decoded URL path matches a configured prefix, but the raw percent-encoded path does not. This inconsistency causes an assert! to fail within the server's processing logic, triggering an HTTP 500 error or, critically, leading to the full termination of the server process, depending on the server's panic configuration. The successful exploitation of this vulnerability results in a Denial of Service (DoS) for the affected web application.

Attack Chain

  1. An unauthenticated attacker identifies an internet-facing web server running a vulnerable version of the Rouille framework (0.1.6 through 3.6.2).
  2. The attacker crafts a HTTP GET or POST request containing a maliciously constructed percent-encoded URL.
  3. The crafted URL is designed so that when its path is decoded by the server, it would match a prefix configured on the server, but its raw, percent-encoded form does not meet the same prefix matching condition.
  4. The vulnerable Rouille server receives the request and processes the URL using the Request::remove_prefix function.
  5. During the prefix removal logic, the assertion assert! evaluates to false due to the unexpected mismatch between the decoded and raw URL path conditions.
  6. The assertion failure triggers an internal server error (HTTP 500) or, in critical configurations, causes the entire Rouille server process to crash and terminate, leading to a Denial of Service.

Impact

Successful exploitation of CVE-2026-66754 allows remote, unauthenticated attackers to instigate a Denial of Service (DoS) condition on vulnerable Rouille web servers. This can manifest as either persistent HTTP 500 internal server errors, rendering web applications temporarily inaccessible, or a full crash and termination of the web server process, leading to complete service disruption. Organizations relying on Rouille for their web infrastructure may experience significant downtime, loss of revenue, and reputational damage. While specific victim counts or targeted sectors are not detailed, any organization utilizing vulnerable versions of Rouille is at risk.

Recommendation

  • Patch Rouille to a version beyond 3.6.2 immediately to remediate CVE-2026-66754.
  • Monitor web server access logs for requests containing highly complex or unusual percent-encoding within the URL path, particularly if followed by HTTP 500 status codes or sudden application crashes.
  • Implement a Web Application Firewall (WAF) to inspect and potentially block malformed or excessively percent-encoded URLs directed at Rouille servers.
  • Configure server logging to capture details of application crashes or unexpected server process terminations.
]]>lowadvisoryrouilleweb-serverdosvulnerabilitycverust