Source: rust-rouille Version: 3.6.2+20250617+ds-3 Severity: grave Tags: security upstream Justification: user security hole X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi I'm filling this with RC level as the upstream project seems umaintained for now, is this correct? Is rust-rouille a candidate we should consider for removal for forky? The following vulnerabilities were published for rust-rouille. CVE-2026-66746[0]: | Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting | vulnerability that allows remote attackers to inject arbitrary | response headers by embedding carriage return (0x0D) or line feed | (0x0A) bytes into attacker-controlled input. Attackers can exploit | percent-decoded query parameters reflected into response headers or | inject bare LF characters into Cookie header values that are | interpolated directly into Set-Cookie response headers, enabling | cache poisoning, session fixation, and security header override | attacks such as bypassing CSP or CORS policies. CVE-2026-66754[1]: | Rouille 0.1.6 through 3.6.2 contains a reachable assertion | vulnerability in the Request::remove_prefix function that allows | remote unauthenticated attackers to crash the server by sending a | crafted percent-encoded URL. Attackers can send a request whose | decoded path matches a configured prefix while the raw percent- | encoded path does not, causing the assert! to fail and triggering | either a 500 error or full process termination depending on the | panic configuration. CVE-2026-67181[2]: | Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling | vulnerability that allows remote attackers to desynchronize HTTP | message boundaries by exploiting improper header forwarding in the | proxy implementation. The proxy in src/proxy.rs forwards the | client's Transfer-Encoding header to upstream backends unchanged | while transmitting a body already de-chunked by tiny_http, enabling | CL.TE desynchronization attacks where attackers control where the | backend believes the request body ends. CVE-2026-67182[3]: | Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling | vulnerability that allows remote attackers to bypass access controls | by injecting bare line feed characters (0x0A) into client-supplied | request header values that are copied verbatim to upstream | connections without validation. Attackers can craft a header value | containing a complete additional HTTP request that is interpreted as | a separate request by backends such as Go net/http and Python | http.server, causing the backend to process a smuggled request with | attacker-chosen method, path, and headers that bypasses the rouille | handler's access control logic. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-66746 https://www.cve.org/CVERecord?id=CVE-2026-66746 [1] https://security-tracker.debian.org/tracker/CVE-2026-66754 https://www.cve.org/CVERecord?id=CVE-2026-66754 [2] https://security-tracker.debian.org/tracker/CVE-2026-67181 https://www.cve.org/CVERecord?id=CVE-2026-67181 [3] https://security-tracker.debian.org/tracker/CVE-2026-67182 https://www.cve.org/CVERecord?id=CVE-2026-67182 Regards, Salvatore
