HTTP Request Smuggling in Rouille Proxy

Executive Summary

CVE-2026-67181 is an HTTP request smuggling vulnerability in the rouille Rust web framework's proxy module. The proxy forwards the client's Transfer-Encoding header to the backend without modification while the request body is already de-chunked by tiny_http. This allows attackers to craft requests where the body contains a second HTTP request, which the backend may process as a separate request. The issue affects versions 0.3.3 through 3.6.2 of rouille.

The root cause is tiny_http's handling of Transfer-Encoding, which discards Content-Length and always applies chunked decoding when the header is present. The proxy forwards all headers except Connection and writes the decoded body directly, leaving the backend to parse the smuggled request.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for HTTP request smuggling indicators such as inconsistent Content-Length and Transfer-Encoding headers. Use tools like Burp Suite or curl to send crafted requests with conflicting headers and observe backend responses for desynchronization. Check proxy logs for malformed requests or unexpected request parsing.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to desynchronization between what the client sent, what rouille observed, and what the backend processed. It may cause incorrect request body logging, bypass of security controls, or unauthorized requests if the backend pipelines requests or uses connection pooling. Attackers can manipulate where the backend interprets the end of the request body.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update or patch the rouille proxy module to skip forwarding Transfer-Encoding, Content-Length, and Connection headers. If no patch is available, disable the proxy functionality or switch to an alternative framework. Monitor network traffic for signs of exploitation attempts.

Useful 0 Not Useful 0