CVE-2026-67181: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in tomaka rouille
Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize HTTP message boundaries by exploiting improper header forwarding in the proxy implementation. The proxy in src/proxy.rs forwards the client's Transfer-Encoding header to upstream backends unchanged while transmitting a body already de-chunked by tiny_http, enabling CL.TE desynchronization attacks where attackers control where the backend believes the request body ends.
AI Analysis
Technical Summary
CVE-2026-67181 is an HTTP request smuggling vulnerability in the tomaka rouille library, specifically in versions 0.3.3 through 3.6.2. The issue arises because the proxy component forwards the client's Transfer-Encoding header to upstream backends without modification, despite the body being already de-chunked by tiny_http. This mismatch enables attackers to perform CL.TE (Content-Length and Transfer-Encoding) desynchronization attacks, causing the backend to misinterpret HTTP message boundaries.
Potential Impact
The vulnerability allows remote attackers to desynchronize HTTP message boundaries between the proxy and backend servers. This can lead to request smuggling attacks where the backend server processes HTTP requests differently than intended, potentially causing security issues such as request hijacking or bypassing security controls. However, there are no known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should be cautious when deploying the affected versions of rouille in proxy configurations that forward Transfer-Encoding headers. Monitoring vendor communications for updates is recommended.
CVE-2026-67181: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in tomaka rouille
Description
Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize HTTP message boundaries by exploiting improper header forwarding in the proxy implementation. The proxy in src/proxy.rs forwards the client's Transfer-Encoding header to upstream backends unchanged while transmitting a body already de-chunked by tiny_http, enabling CL.TE desynchronization attacks where attackers control where the backend believes the request body ends.
CVSS v4.0
Score 6.3medium
Affected software
tomaka
rouille
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-67181 is an HTTP request smuggling vulnerability in the tomaka rouille library, specifically in versions 0.3.3 through 3.6.2. The issue arises because the proxy component forwards the client's Transfer-Encoding header to upstream backends without modification, despite the body being already de-chunked by tiny_http. This mismatch enables attackers to perform CL.TE (Content-Length and Transfer-Encoding) desynchronization attacks, causing the backend to misinterpret HTTP message boundaries.
Potential Impact
The vulnerability allows remote attackers to desynchronize HTTP message boundaries between the proxy and backend servers. This can lead to request smuggling attacks where the backend server processes HTTP requests differently than intended, potentially causing security issues such as request hijacking or bypassing security controls. However, there are no known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should be cautious when deploying the affected versions of rouille in proxy configurations that forward Transfer-Encoding headers. Monitoring vendor communications for updates is recommended.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-07-28T16:06:49.773Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a68d7619c2644c7f8e0516a
Added to database: 07/28/2026, 16:22:57 UTC
Last enriched: 07/29/2026, 23:35:39 UTC
Last updated: 09/11/2026, 22:06:34 UTC
Views: 60
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.