CVE-2026-67181 Details

An HTTP request smuggling vulnerability has been identified in Rouille versions 0.3.3 through 3.6.2. This vulnerability allows remote attackers to desynchronize HTTP message boundaries by exploiting improper header forwarding in the proxy implementation. The proxy forwards the client's Transfer-Encoding header to upstream backends without modification, while sending a body that has already been de-chunked by tiny_http. This creates an opportunity for CL.TE desynchronization attacks, where attackers can control how the backend interprets the request body.

To address this vulnerability, do not forward framing headers that describe a body that has already been decoded by Rouille. Instead, emit accurate framing that reflects the actual data being sent, such as by including a correct Content-Length header or re-chunking the body before sending it to the backend.