Executive brief
Rouille, a Rust-based web server library, is vulnerable to a security flaw that could allow attackers to bypass intended access controls. By sending specially crafted web requests, an attacker can trick the system into processing hidden, unauthorized commands as if they were legitimate. This could lead to unauthorized actions being performed on the backend server, potentially compromising the integrity of the application's operations.
Technical details
Rouille versions 0.3.3 through 3.6.2 are susceptible to HTTP Request Smuggling (CWE-444) due to improper validation of header values. The library copies client-supplied request headers verbatim to upstream connections without sanitizing bare line feed characters (0x0A). An attacker can exploit this by injecting a line feed followed by a complete second HTTP request within a header value. When processed by backend servers that interpret these characters as request delimiters (such as Go's net/http or Python's http.server), the smuggled request is executed with attacker-controlled methods and paths, effectively bypassing any access control logic implemented in the Rouille handler.
Affected products
- tomaka rouille 0.3.3 through 3.6.2
Timeline
- 2026-07-28: advisory: NVD publication date
- 2026-07-28: disclosed: VulnCheck advisory published