CVE-2026-66754 Details

A reachable assertion vulnerability has been identified in the Rouille HTTP server framework, specifically in versions 0.1.6 through 3.6.2. The vulnerability resides in the Request::remove_prefix function, where the assertion checks the raw percent-encoded URL against a configured prefix. This mismatch allows remote unauthenticated attackers to send crafted URLs that trigger the assertion failure, causing the server to crash. Depending on the panic configuration, this can result in a 500 error or a complete termination of the server process.

The vulnerability can be remediated by modifying the remove_prefix function to compare and slice the URL using the same representation. If the intention is to decode the URL for comparison, it should be done once, with the prefix stripped and the remainder re-encoded, rather than slicing the raw URL. Additionally, the assertion should be removed, as libraries should not terminate the process due to input from users.