Bug#1142994: rust-rouille: CVE-2026-66746 CVE-2026-66754 CVE-2026-67181 CVE-2026-67182

Source: rust-rouille
Version: 3.6.2+20250617+ds-3
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>

Hi

I'm filling this with RC level as the upstream project seems
umaintained for now, is this correct? Is rust-rouille a candidate we
should consider for removal for forky?

The following vulnerabilities were published for rust-rouille.

CVE-2026-66746[0]:
| Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting
| vulnerability that allows remote attackers to inject arbitrary
| response headers by embedding carriage return (0x0D) or line feed
| (0x0A) bytes into attacker-controlled input. Attackers can exploit
| percent-decoded query parameters reflected into response headers or
| inject bare LF characters into Cookie header values that are
| interpolated directly into Set-Cookie response headers, enabling
| cache poisoning, session fixation, and security header override
| attacks such as bypassing CSP or CORS policies.


CVE-2026-66754[1]:
| Rouille 0.1.6 through 3.6.2 contains a reachable assertion
| vulnerability in the Request::remove_prefix function that allows
| remote unauthenticated attackers to crash the server by sending a
| crafted percent-encoded URL. Attackers can send a request whose
| decoded path matches a configured prefix while the raw percent-
| encoded path does not, causing the assert! to fail and triggering
| either a 500 error or full process termination depending on the
| panic configuration.


CVE-2026-67181[2]:
| Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling
| vulnerability that allows remote attackers to desynchronize HTTP
| message boundaries by exploiting improper header forwarding in the
| proxy implementation. The proxy in src/proxy.rs forwards the
| client's Transfer-Encoding header to upstream backends unchanged
| while transmitting a body already de-chunked by tiny_http, enabling
| CL.TE desynchronization attacks where attackers control where the
| backend believes the request body ends.


CVE-2026-67182[3]:
| Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling
| vulnerability that allows remote attackers to bypass access controls
| by injecting bare line feed characters (0x0A) into client-supplied
| request header values that are copied verbatim to upstream
| connections without validation. Attackers can craft a header value
| containing a complete additional HTTP request that is interpreted as
| a separate request by backends such as Go net/http and Python
| http.server, causing the backend to process a smuggled request with
| attacker-chosen method, path, and headers that bypasses the rouille
| handler's access control logic.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-66746
    https://www.cve.org/CVERecord?id=CVE-2026-66746
[1] https://security-tracker.debian.org/tracker/CVE-2026-66754
    https://www.cve.org/CVERecord?id=CVE-2026-66754
[2] https://security-tracker.debian.org/tracker/CVE-2026-67181
    https://www.cve.org/CVERecord?id=CVE-2026-67181
[3] https://security-tracker.debian.org/tracker/CVE-2026-67182
    https://www.cve.org/CVERecord?id=CVE-2026-67182

Regards,
Salvatore