CVE-2026-66754: Rouille DoS Vulnerability

CVE-2026-66754 Overview

CVE-2026-66754 is a reachable assertion vulnerability in the Rouille Rust web framework, versions 0.1.6 through 3.6.2. The flaw resides in the Request::remove_prefix function and is triggered by a crafted percent-encoded URL. Remote unauthenticated attackers can send a request whose decoded path matches a configured prefix while the raw percent-encoded path does not. This mismatch causes the internal assert! to fail, panicking the request handler. Depending on the panic configuration, the server responds with a 500 error or terminates the entire process. The issue is classified under [CWE-617] Reachable Assertion.

Critical Impact
Unauthenticated attackers can crash Rouille-based servers over the network with a single crafted HTTP request, causing denial of service.

Affected Products

Rouille 0.1.6 through 3.6.2
Rust applications embedding the Rouille HTTP server library
Services exposing prefix-based routing configured via Request::remove_prefix

Discovery Timeline

2026-07-28 - CVE-2026-66754 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-66754

Vulnerability Analysis

Rouille is a synchronous Rust web micro-framework used to serve HTTP endpoints. The Request::remove_prefix helper checks whether an incoming request path begins with a configured prefix and strips it before dispatching to downstream handlers. The routine performs the prefix comparison against the URL-decoded path but then asserts the same relationship against the raw percent-encoded path. When those two representations diverge, the assertion fails and Rust triggers a panic. A remote attacker without credentials can weaponize this behavior by encoding the prefix characters. The result is a network-reachable denial of service against every deployment relying on prefix routing.

Root Cause

The defect stems from inconsistent handling of percent-encoded and decoded URL representations inside Request::remove_prefix. The function relies on an invariant that both forms share the same prefix. That invariant is enforced by assert! rather than by graceful error handling. Any crafted path that decodes to the configured prefix but does not literally start with it violates the invariant and panics the thread.

Attack Vector

An attacker sends a single HTTP request to any Rouille endpoint that uses prefix routing. For a prefix such as /api, the raw request path can be encoded as /%61pi/.... The decoded form matches /api, satisfying the prefix check, while the raw form does not, failing the follow-up assertion. If the process is compiled with panic = "abort", the entire server terminates and stops accepting connections. If unwinding is enabled, the connection returns HTTP 500, but repeated requests still exhaust worker threads and degrade availability. Refer to the VulnCheck Security Advisory and the GitHub PoC Repository for the reproduction details.

Detection Methods for CVE-2026-66754

Indicators of Compromise

HTTP request paths containing percent-encoded alphanumeric characters that decode to a configured route prefix, for example /%61pi/ targeting a /api prefix.
Application logs showing Rust panics referencing Request::remove_prefix or assertion failed.
Unexpected process restarts or worker thread termination on hosts running Rouille-based services.

Detection Strategies

Inspect web access logs for requests whose raw path contains % escapes for characters that are valid in the routing prefix.
Correlate HTTP 500 responses from Rouille endpoints with panic messages emitted to stderr or the container log stream.
Monitor process supervisors (systemd, runit, Kubernetes) for repeated restarts of Rouille workloads shortly after inbound traffic spikes.

Monitoring Recommendations

Alert on any panic stack trace containing the rouille crate frames.
Track request rate for percent-encoded paths against Rouille services and baseline typical volumes.
Instrument reverse proxies to log both the raw and decoded request-URI so panic-inducing inputs can be reconstructed.

How to Mitigate CVE-2026-66754

Immediate Actions Required

Inventory all Rust services and identify dependencies on the rouille crate within version 0.1.6 through 3.6.2.
Upgrade to a fixed Rouille release once published by the maintainers; track the VulnCheck Security Advisory for version details.
Place a reverse proxy in front of Rouille services to normalize or reject percent-encoded route prefixes.

Patch Information

No fixed version was listed in the NVD entry at publication. Monitor the Rouille project on crates.io and the linked advisory for a patched release. Until a patched crate is available, apply the mitigations below.

Workarounds

Configure an upstream reverse proxy such as nginx, HAProxy, or Envoy to decode and canonicalize request paths before forwarding to Rouille.
Reject requests whose raw path contains percent-encoded characters that overlap with configured route prefixes.
Compile Rouille services with panic = "unwind" so that a single malicious request cannot terminate the entire process, then combine with rate limiting to blunt repeated attempts.
Where feasible, remove reliance on Request::remove_prefix and perform routing on already-decoded paths within application code.

bash

# nginx example: normalize percent-encoding and drop suspicious escapes
# before proxying traffic to a Rouille backend on port 8000
server {
    listen 443 ssl;
    server_name app.example.com;

    location /api/ {
        if ($request_uri ~* "%[0-9a-fA-F]{2}") {
            return 400;
        }
        proxy_pass http://127.0.0.1:8000;
        proxy_set_header Host $host;
    }
}