Description
Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize HTTP message boundaries by exploiting improper header forwarding in the proxy implementation. The proxy in src/proxy.rs forwards the client's Transfer-Encoding header to upstream backends unchanged while transmitting a body already de-chunked by tiny_http, enabling CL.TE desynchronization attacks where attackers control where the backend believes the request body ends.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| tomaka | rouille | 0.3.3 – ≤ 3.6.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rust-rouille | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | sccache | 0.17.0~1-150600.10.14.1 | SUSE-SU-2026:3674-1 |
| SLES 15 SP6 | sccache | 0.17.0~1-150600.10.14.1 | SUSE-SU-2026:3674-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | sccache | 0.18.0~2-160000.1.1 | SUSE-SU-2026:23983-1 |
| SLES for SAP 15 SP6 | sccache | 0.17.0~1-150600.10.14.1 | SUSE-SU-2026:3674-1 |
| SLES 16.0 | sccache | 0.18.0~2-160000.1.1 | SUSE-SU-2026:23983-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | sccache | 0.17.0~1-2.1 | openSUSE-SU-2026:11527-1 |
| openSUSE Leap 16.0 | sccache | 0.18.0~2-160000.1.1 | openSUSE-SU-2026:21982-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
theopaid/CVE-2026-67181-HTTP-Request-Smuggling-via-Transfer-Encoding-Desynchronization-rouille- ★ 1 · Jul 26, 2026
Security Advisory: HTTP Request Smuggling via Transfer-Encoding Desynchronization (rouille)
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 4
- SUSE-SU-2026:23983-1 Security update for sccache SUSE / openSUSE Security Updates · Oct 6, 2026
- openSUSE-SU-2026:21982-1 Security update for sccache SUSE / openSUSE Security Updates · Oct 1, 2026
- SUSE-SU-2026:3674-1 Security update for sccache SUSE / openSUSE Security Updates · Aug 22, 2026
- openSUSE-SU-2026:11527-1 sccache-0.17.0~1-2.1 on GA media SUSE / openSUSE Security Updates · Aug 16, 2026
References
- Researcher Disclosure technical-description exploit
- https://www.vulncheck.com/advisories/rouille-http-request-smuggling-via-proxy-transfer-encoding-header third-party-advisory