CVE-2026-67181

Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize HTTP message boundaries by exploiting improper header forwarding in the proxy implementation. The proxy in src/proxy.rs forwards the client's Transfer-Encoding header to upstream backends unchanged while transmitting a body already de-chunked by tiny_http, enabling CL.TE desynchronization attacks where attackers control where the backend believes the request body ends.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://github.com/theopaid/HTTP-Request-Smuggling-via-Transfer-Encoding-Desynchronization-rouille-
https://www.vulncheck.com/advisories/rouille-http-request-smuggling-via-proxy-transfer-encoding-header

Configurations

No configuration.

History

24 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Rouille 0.3.3 hasta 3.6.2 contiene una vulnerabilidad de contrabando de solicitudes HTTP que permite a atacantes remotos desincronizar los límites de mensajes HTTP explotando el reenvío inadecuado de encabezados en la implementación del proxy. El proxy en src/proxy.rs reenvía el encabezado Transfer-Encoding del cliente a los backends ascendentes sin cambios mientras transmite un cuerpo ya descodificado en trozos por tiny_http, lo que permite ataques de desincronización CL.TE donde los atacantes controlan dónde el backend cree que termina el cuerpo de la solicitud.

Information

Published : 2026-07-28 16:20

Updated : 2026-10-24 13:10

NVD link : CVE-2026-67181

Mitre link : CVE-2026-67181

CVE.ORG link : CVE-2026-67181

JSON object : View

Products Affected

No product.

CWE

CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

{"id": "CVE-2026-67181", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-67181", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-28T16:35:12.931288Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 2.7, "exploitabilityScore": 2.2}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/tomaka/rouille", "vendor": "tomaka", "product": "rouille", "versions": [{"status": "affected", "version": "0.3.3", "versionType": "semver", "lessThanOrEqual": "3.6.2"}], "packageURL": "pkg:github/tomaka/rouille", "defaultStatus": "affected"}]}], "published": "2026-07-28T16:20:20.103", "references": [{"url": "https://github.com/theopaid/HTTP-Request-Smuggling-via-Transfer-Encoding-Desynchronization-rouille-", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/rouille-http-request-smuggling-via-proxy-transfer-encoding-header", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-444"}]}], "descriptions": [{"lang": "en", "value": "Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize HTTP message boundaries by exploiting improper header forwarding in the proxy implementation. The proxy in src/proxy.rs forwards the client's Transfer-Encoding header to upstream backends unchanged while transmitting a body already de-chunked by tiny_http, enabling CL.TE desynchronization attacks where attackers control where the backend believes the request body ends."}, {"lang": "es", "value": "Rouille 0.3.3 hasta 3.6.2 contiene una vulnerabilidad de contrabando de solicitudes HTTP que permite a atacantes remotos desincronizar los l\u00edmites de mensajes HTTP explotando el reenv\u00edo inadecuado de encabezados en la implementaci\u00f3n del proxy. El proxy en src/proxy.rs reenv\u00eda el encabezado Transfer-Encoding del cliente a los backends ascendentes sin cambios mientras transmite un cuerpo ya descodificado en trozos por tiny_http, lo que permite ataques de desincronizaci\u00f3n CL.TE donde los atacantes controlan d\u00f3nde el backend cree que termina el cuerpo de la solicitud."}], "lastModified": "2026-10-24T13:10:00.147", "sourceIdentifier": "disclosure@vulncheck.com"}