Description
Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::remove_prefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL. Attackers can send a request whose decoded path matches a configured prefix while the raw percent-encoded path does not, causing the assert! to fail and triggering either a 500 error or full process termination depending on the panic configuration.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| tomaka | rouille | 0.1.6 – ≤ 3.6.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rust-rouille | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | sccache | 0.17.0~1-150600.10.14.1 | SUSE-SU-2026:3674-1 |
| SLES 15 SP6 | sccache | 0.17.0~1-150600.10.14.1 | SUSE-SU-2026:3674-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | sccache | 0.18.0~2-160000.1.1 | SUSE-SU-2026:23983-1 |
| SLES for SAP 15 SP6 | sccache | 0.17.0~1-150600.10.14.1 | SUSE-SU-2026:3674-1 |
| SLES 16.0 | sccache | 0.18.0~2-160000.1.1 | SUSE-SU-2026:23983-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | sccache | 0.17.0~1-2.1 | openSUSE-SU-2026:11527-1 |
| openSUSE Leap 16.0 | sccache | 0.18.0~2-160000.1.1 | openSUSE-SU-2026:21982-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
theopaid/CVE-2026-66754-Remote-Denial-of-Service-via-Reachable-Assertion-in-URL-Prefix-Handling-rouille- ★ 0 · Jul 26, 2026
Security Advisory: Remote Denial of Service via Reachable Assertion in URL Prefix Handling (rouille)
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 4
- SUSE-SU-2026:23983-1 Security update for sccache SUSE / openSUSE Security Updates · Oct 6, 2026
- openSUSE-SU-2026:21982-1 Security update for sccache SUSE / openSUSE Security Updates · Oct 1, 2026
- SUSE-SU-2026:3674-1 Security update for sccache SUSE / openSUSE Security Updates · Aug 22, 2026
- openSUSE-SU-2026:11527-1 sccache-0.17.0~1-2.1 on GA media SUSE / openSUSE Security Updates · Aug 16, 2026
References
- Researcher Disclosure technical-description exploit
- https://www.vulncheck.com/advisories/rouille-reachable-assertion-dos-via-remove-prefix-percent-encoding third-party-advisory