Vulnerability in Tomaka Rouille
CVE-2026-67181
Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize HTTP message boundaries by exploiting improper header forwarding in the proxy implementation. The proxy in src/proxy.rs forwards the client's Transfer-Encoding header to upstream backends unchanged while transmitting a body already de-chunked by tiny_http, enabling CL.TE desynchronization attacks where attackers control where the backend believes the request body ends.
Vulnerability class: HTTP Request Smuggling
EPSS: 0.003 (21.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L.
Affected products
- Tomaka Rouille — versions 0.3.3
Weakness classification (CWE)
Public proof-of-concept exploits
References
- disclosure@vulncheck.com (technical-description, exploit)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2026-67181?
- CVE-2026-67181 is a medium-severity vulnerability in Tomaka Rouille, classified under Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling). CVSS score: 5.4/10. Published 2026-07-28.
- How severe is CVE-2026-67181?
- Medium severity. CVSS v3 base score is 5.4 out of 10.
- Is CVE-2026-67181 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.