{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/rouille/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-67181"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Rouille 0.3.3 through 3.6.2"],"_cs_severities":["high"],"_cs_tags":["web-vulnerability","http-request-smuggling","server-side"],"_cs_type":"advisory","_cs_vendors":["Rouille"],"content_html":"\u003cp\u003eRouille, an HTTP server framework for Rust, specifically versions 0.3.3 through 3.6.2, is affected by an HTTP request smuggling vulnerability identified as CVE-2026-67181. This flaw stems from a defect in the framework's proxy implementation, particularly within the \u003ccode\u003esrc/proxy.rs\u003c/code\u003e component. Attackers can exploit this by sending a crafted HTTP request where the \u003ccode\u003eTransfer-Encoding\u003c/code\u003e header is improperly forwarded to upstream backends. While the \u003ccode\u003etiny_http\u003c/code\u003e component de-chunks the request body, the original \u003ccode\u003eTransfer-Encoding\u003c/code\u003e header is sent verbatim to the backend, enabling a \u0026quot;CL.TE\u0026quot; (Content-Length.Transfer-Encoding) desynchronization attack. This allows adversaries to manipulate how the backend perceives the end of an HTTP request, potentially leading to cache poisoning, bypassing security mechanisms, or unauthorized access to internal resources. The vulnerability carries a CVSS v3.1 Base Score of 7.2, indicating a high severity risk.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker sends a specially crafted HTTP request to a vulnerable Rouille proxy server.\u003c/li\u003e\n\u003cli\u003eThe crafted request includes a \u003ccode\u003eTransfer-Encoding: chunked\u003c/code\u003e header and a \u003ccode\u003eContent-Length\u003c/code\u003e header, designed to create ambiguity for the backend.\u003c/li\u003e\n\u003cli\u003eThe Rouille proxy, using \u003ccode\u003etiny_http\u003c/code\u003e, processes and de-chunks the request body received from the client.\u003c/li\u003e\n\u003cli\u003eThe proxy then forwards the request to an upstream backend, but critically, it forwards the client's original \u003ccode\u003eTransfer-Encoding: chunked\u003c/code\u003e header unchanged.\u003c/li\u003e\n\u003cli\u003eThis creates a desynchronization: the proxy interprets the request body based on the de-chunked content, while the upstream backend attempts to interpret the request based on the forwarded \u003ccode\u003eTransfer-Encoding: chunked\u003c/code\u003e header.\u003c/li\u003e\n\u003cli\u003eBy carefully crafting subsequent requests and controlling chunk sizes, the attacker can cause the backend to interpret the end of one request differently than the proxy, allowing parts of the attacker's next request to be prepended to legitimate users' requests.\u003c/li\u003e\n\u003cli\u003eThis technique can be used to inject malicious content into cache entries, bypass security appliances, or gain unauthorized access to internal application logic.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-67181 can lead to various severe consequences for organizations utilizing affected Rouille proxy implementations. The primary impact involves the bypassing of security controls, including web application firewalls (WAFs) and intrusion prevention systems, as the smuggled requests may not be properly inspected. Attackers could also achieve cache poisoning, leading to the serving of malicious or manipulated content to legitimate users. In some scenarios, request smuggling can facilitate unauthorized access to sensitive internal resources or administrative interfaces, potentially escalating to remote code execution (RCE) on the backend servers if further vulnerabilities are chained. While specific victim counts are not available, any organization deploying Rouille as an HTTP proxy in versions 0.3.3 through 3.6.2 is at risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-67181 on all Rouille HTTP server deployments to version 3.6.3 or newer immediately.\u003c/li\u003e\n\u003cli\u003eDeploy the provided Sigma rule to your SIEM to detect suspicious HTTP request headers indicative of request smuggling attempts.\u003c/li\u003e\n\u003cli\u003eMonitor \u003ccode\u003ewebserver\u003c/code\u003e logs for HTTP requests containing conflicting \u003ccode\u003eContent-Length\u003c/code\u003e and \u003ccode\u003eTransfer-Encoding\u003c/code\u003e headers, as these are common indicators of request smuggling.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-28T16:23:37Z","date_published":"2026-07-28T16:23:37Z","id":"https://feed.craftedsignal.io/briefs/2026-07-rouille-http-request-smuggling/","summary":"Rouille HTTP server framework versions 0.3.3 through 3.6.2 are vulnerable to an HTTP request smuggling attack, CVE-2026-67181, allowing remote attackers to desynchronize HTTP message boundaries by exploiting improper header forwarding in the proxy implementation, leading to potential bypassing of security controls or unauthorized access.","title":"Rouille HTTP Server Framework Vulnerable to Request Smuggling (CVE-2026-67181)","url":"https://feed.craftedsignal.io/briefs/2026-07-rouille-http-request-smuggling/"}],"language":"en","title":"CraftedSignal Threat Feed - Rouille","version":"https://jsonfeed.org/version/1.1"}