CVE-2026-66754

MEDIUM 5.9

Rouille 0.1.6 - 3.6.2 Reachable Assertion DoS via remove_prefix percent-encoding

CVSS Score

5.9

EPSS Score

0.0%

EPSS Percentile

0th

Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::remove_prefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL. Attackers can send a request whose decoded path matches a configured prefix while the raw percent-encoded path does not, causing the assert! to fail and triggering either a 500 error or full process termination depending on the panic configuration.

CWE	CWE-617
Vendor	tomaka
Product	rouille
Published	Jul 28, 2026
Last Updated	Jul 28, 2026

Stay Ahead of the Next One

Get instant alerts for tomaka rouille

Be the first to know when new medium vulnerabilities affecting tomaka rouille are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

tomaka / rouille

0.1.6 ≤ 3.6.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/theopaid/Remote-Denial-of-Service-via-Reachable-Assertion-in-URL-Prefix-Handling-rouille- vulncheck.com: https://www.vulncheck.com/advisories/rouille-reachable-assertion-dos-via-remove-prefix-percent-encoding

Credits

Theodosis Paidakis