Executive brief
Rouille, a web server library for the Rust programming language, contains a flaw in how it handles specific web addresses. An unauthenticated attacker can send a specially crafted web request that causes the server to crash or return error messages. Depending on how the server is configured, this could lead to a complete service outage, impacting business operations and availability.
Technical details
A reachable assertion vulnerability (CWE-617) exists in the `Request::remove_prefix` function of the Rouille library. The function performs a check on the percent-decoded URL path but executes an `assert!` statement against the raw, encoded path. By sending a request where the decoded path matches a configured prefix but the raw path does not (e.g., by percent-encoding a character within the prefix), an attacker can trigger an assertion failure. Depending on the Rust panic configuration, this results in either a 500 Internal Server Error or immediate process termination (Denial of Service). This attack is reachable over the network without authentication.
Affected products
- tomaka rouille 0.1.6 through 3.6.2
Timeline
- 2026-07-28: advisory: NVD and VulnCheck published the advisory.