CVE-2026-66754
Received Received - Intake

Rouille percent-encoded URL assertion failure

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: VulnCheck

Description
Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::remove_prefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL. Attackers can send a request whose decoded path matches a configured prefix while the raw percent-encoded path does not, causing the assert! to fail and triggering either a 500 error or full process termination depending on the panic configuration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-66754
EUVD
EUVD-2026-49888

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
rouille rouille From 0.1.6 (inc) to 3.6.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-617 The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a reachable assertion vulnerability in the Rouille Rust web framework versions 0.1.6 through 3.6.2. It occurs in the Request::remove_prefix function where a crafted percent-encoded URL can cause an assertion failure. The issue arises when the decoded URL path matches a configured prefix but the raw percent-encoded path does not, leading to a crash or 500 error depending on panic settings.

Detection Guidance

To detect this vulnerability, monitor for crashes or 500 errors when processing percent-encoded URLs. Check server logs for assertion failures in the Request::remove_prefix function. Use tools like curl to send crafted requests with mismatched percent-encoded and decoded paths.

Impact Analysis

This vulnerability allows remote unauthenticated attackers to crash the server by sending a single malicious request. It can cause either a 500 error or complete server termination, leading to denial of service. Systems using affected Rouille versions are vulnerable to availability disruption without requiring authentication or user interaction.

Mitigation Strategies

Immediately upgrade rouille to a patched version beyond 3.6.2. If upgrading is not possible, implement network-level protections to filter malicious percent-encoded URLs. Disable panic abort configurations to ensure graceful 500 errors instead of process termination.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66754. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart