CVE-2026-67181: Rouille HTTP Request Smuggling Flaw

CVE-2026-67181 Overview

CVE-2026-67181 is an HTTP request smuggling vulnerability affecting the Rouille web framework versions 0.3.3 through 3.6.2. The flaw resides in the proxy implementation at src/proxy.rs, which forwards the client-supplied Transfer-Encoding header to upstream backends without modification. Because tiny_http already de-chunks the request body before it reaches the proxy, the proxy transmits a de-chunked body alongside a chunked encoding declaration. This mismatch enables CL.TE (Content-Length / Transfer-Encoding) desynchronization attacks. Remote attackers can manipulate where the backend interprets request boundaries, allowing them to smuggle a second request past front-end controls. The vulnerability is categorized under CWE-444: Inconsistent Interpretation of HTTP Requests.

Critical Impact
Attackers can desynchronize proxy-backend HTTP parsing to bypass security controls, poison caches, and hijack subsequent user requests routed through Rouille.

Affected Products

Rouille web framework versions 0.3.3 through 3.6.2
Rust applications using Rouille's src/proxy.rs reverse proxy functionality
Deployments where Rouille sits in front of upstream HTTP backends

Discovery Timeline

2026-07-28 - CVE-2026-67181 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-67181

Vulnerability Analysis

Rouille integrates the tiny_http server library to parse incoming HTTP requests. When tiny_http receives a chunked-encoded request, it transparently decodes the chunked body and exposes the raw, de-chunked payload to the application layer. The proxy module in src/proxy.rs then constructs an outbound request to the upstream backend, copying client headers including the original Transfer-Encoding: chunked header. However, the body transmitted upstream is no longer chunked. The upstream backend receives a request that advertises chunked transfer encoding but contains a plain body, creating an ambiguous message boundary. This inconsistency between the proxy and the backend is the classic precondition for HTTP request smuggling.

Root Cause

The root cause is improper header forwarding in the proxy layer. Rouille's proxy does not strip or rewrite hop-by-hop headers such as Transfer-Encoding after tiny_http has already normalized the body. HTTP intermediaries are required to reprocess Transfer-Encoding per RFC 7230 rather than blindly forward it, and Rouille violates that requirement.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP request with both a Content-Length header and a Transfer-Encoding: chunked header. Rouille de-chunks the body but forwards the Transfer-Encoding header unchanged. The backend parses the request using the chunked encoding, while Rouille framed it using Content-Length. The attacker embeds a second, hidden HTTP request inside what the backend treats as trailing bytes. That smuggled request is then attributed to the next legitimate client connection, enabling cache poisoning, credential theft, security control bypass, and request queue hijacking. Full technical details are available in the VulnCheck Security Advisory and the GitHub PoC Repository.

Detection Methods for CVE-2026-67181

Indicators of Compromise

HTTP requests containing both Content-Length and Transfer-Encoding headers arriving at Rouille-fronted services
Backend access logs showing requests with malformed or unexpected method verbs at unusual byte offsets
Unexplained response mismatches where clients receive responses intended for other sessions

Detection Strategies

Inspect proxy and backend access logs for divergent request counts between the two tiers, a hallmark of desynchronization
Deploy web application firewall (WAF) rules that reject requests containing conflicting Content-Length and Transfer-Encoding headers
Run active smuggling probes such as those documented in the referenced PoC repository against staging environments to confirm exposure

Monitoring Recommendations

Enable verbose logging on both Rouille and upstream backends to correlate request framing on a per-connection basis
Alert on HTTP 400 responses spiking from the backend, which frequently accompany failed smuggling attempts
Monitor for unexpected cross-user data appearing in cached responses served by any downstream cache

How to Mitigate CVE-2026-67181

Immediate Actions Required

Audit all deployments to identify Rouille versions between 0.3.3 and 3.6.2 acting as reverse proxies
Place a hardened front-end proxy such as NGINX or HAProxy in front of Rouille to normalize Transfer-Encoding handling
Reject requests at the perimeter that contain both Content-Length and Transfer-Encoding headers

Patch Information

At the time of publication, no fixed upstream release is referenced in the NVD entry. Monitor the VulnCheck Security Advisory for patch availability. Until a fix is published, apply the workarounds below.

Workarounds

Modify src/proxy.rs in local forks to strip the Transfer-Encoding header before forwarding upstream requests
Force Connection: close on proxied requests to prevent request queue reuse and limit smuggling impact
Restrict Rouille proxy exposure to trusted networks until a patched release is available

bash

# Example NGINX front-end normalization to drop client-supplied Transfer-Encoding
# before traffic reaches a Rouille-based proxy
proxy_set_header Transfer-Encoding "";
proxy_http_version 1.1;
proxy_set_header Connection "close";