Is CVE-2026-67181 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-67181 being exploited in the wild.

How severe is CVE-2026-67181?

High severity, with a CVSS score of 7.2, published 28 July 2026.

Which products and versions are affected?

Tomaka Rouille 0.3.3 through 3.6.2.

Is there a fix for CVE-2026-67181?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-67181 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-67181?

Check whether you run Tomaka Rouille at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-67181: Rouille HTTP request smuggling in proxy implementation

CVE-2026-67181 · Severity: high · CVSS 7.2 · Published 2026-07-28

Rouille, a Rust-based web framework, contains a flaw in how it handles web traffic when acting as a proxy. An attacker can send specially crafted requests that trick the backend server into misinterpreting where one request ends and the next begins. This can allow an attacker to bypass security controls, interfere with other users' sessions, or gain unauthorized access to internal systems.

Technologies: Tomaka Rouille. Vendors: Tomaka.

Quick answers

Is CVE-2026-67181 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-67181 being exploited in the wild.
How severe is CVE-2026-67181?: High severity, with a CVSS score of 7.2, published 28 July 2026.
Which products and versions are affected?: Tomaka Rouille 0.3.3 through 3.6.2.
Is there a fix for CVE-2026-67181?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-67181 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-67181?: Check whether you run Tomaka Rouille at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An HTTP request smuggling vulnerability exists in Rouille's proxy implementation (src/proxy.rs) due to inconsistent interpretation of Transfer-Encoding headers. The framework's underlying server, tiny_http, de-chunks incoming request bodies, but the proxy module forwards the original 'Transfer-Encoding: chunked' header to upstream backends without modification or adding a Content-Length header. This creates a CL.TE desynchronization condition where the backend expects chunked data but receives a raw body, allowing an attacker to 'smuggle' a second request inside the body of the first. This affects applications using the proxy::proxy or proxy::full_proxy functions. As of the advisory date, no fixed version has been released.

Affected products

tomaka Rouille 0.3.3 through 3.6.2

Timeline

2026-07-28: disclosed
2026-07-28: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.