CVE-2026-66754 is a high-severity vulnerability in the tomaka rouille web framework affecting versions 0.1.6 through 3.6.2. The vulnerability exists in the Request::remove_prefix function, where an assertion is reachable and can be triggered by sending a specially crafted percent-encoded URL. When the decoded request path matches a configured prefix but the raw percent-encoded path does not, the assertion fails, causing the server to panic. This can lead to denial of service by crashing the server process or returning a 500 error, depending on the panic handling configuration. The vulnerability requires no authentication and can be exploited remotely.

Remote unauthenticated attackers can cause a denial of service by crashing the server or triggering a 500 error through crafted HTTP requests with percent-encoded URLs. This disrupts availability of services relying on affected versions of rouille. There is no indication of code execution or data breach from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing protective measures such as filtering or normalizing incoming URLs to prevent triggering the assertion. Monitor for updates from the tomaka project regarding an official fix.