Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Vendor: tomaka Clear all filters
TI-2026-47509 CVE-2026-67182 · GHSA-frmw-v2hf-gvj9

Rouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Header Injection

Priority MEDIUM 64

Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to bypass access controls by injecting bare line feed characters (0x0A) into client-supplied request header values…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00629 Published 2026-07-28 No fix listed CWE-444
TI-2026-47508 CVE-2026-67181 · GHSA-fgf8-ph7p-m275

Rouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Transfer-Encoding Header

Priority MEDIUM 61

Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize HTTP message boundaries by exploiting improper header forwarding in the proxy implementation.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00414 Published 2026-07-28 No fix listed CWE-444
TI-2026-47394 CVE-2026-66746 · GHSA-998j-f97v-vpgr

Rouille 0.4.0 - 3.6.2 HTTP Response Splitting via Header Injection

Priority MEDIUM 57

Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return (0x0D) or line feed (0x0A) bytes into attacker-…

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.0034 Published 2026-07-28 No fix listed CWE-113
TI-2026-47402 CVE-2026-66754 · GHSA-mrg5-7f6c-r28q

Rouille 0.1.6 - 3.6.2 Reachable Assertion DoS via remove_prefix percent-encoding

Priority HIGH 69

Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::remove_prefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00565 Published 2026-07-28 No fix listed CWE-617