CVE-2026-66754

MEDIUM

Rouille 0.1.6 - 3.6.2 Reachable Assertion DoS via remove_prefix percent-encoding

Title source: cna

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-66754. PoCs published by theopaid.

AI-analyzed exploit summary This repository provides a detailed technical analysis of CVE-2026-66754, a reachable assertion vulnerability in the rouille web framework's URL prefix handling. The flaw allows remote unauthenticated attackers to trigger a denial-of-service (DoS) via a crafted request with percent-encoded characters in the URL prefix, causing a panic in default builds or server termination in builds with `panic = "abort"`.

Description

Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::remove_prefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL. Attackers can send a request whose decoded path matches a configured prefix while the raw percent-encoded path does not, causing the assert! to fail and triggering either a 500 error or full process termination depending on the panic configuration.

Exploits (1)

github WRITEUP

by theopaid · poc

https://github.com/theopaid/CVE-2026-66754-Remote-Denial-of-Service-via-Reachable-Assertion-in-URL-Prefix-Handling-rouille-

View Code ZIP pw:eip

This repository provides a detailed technical analysis of CVE-2026-66754, a reachable assertion vulnerability in the rouille web framework's URL prefix handling. The flaw allows remote unauthenticated attackers to trigger a denial-of-service (DoS) via a crafted request with percent-encoded characters in the URL prefix, causing a panic in default builds or server termination in builds with `panic = "abort"`.

Classification

Writeup 100%

Attack Type

Dos

Complexity

Trivial

Reliability

Reliable

Target: rouille versions 0.1.6 to 3.6.2

No auth needed

Prerequisites: Target must be running a vulnerable version of rouille · Application must use `Request::remove_prefix` for routing (e.g., static file serving under a URL prefix) · For full DoS, the server must be built with `panic = "abort"`

MITRE ATT&CK

T1499 - Endpoint Denial of Service

mistral-large-3 · analyzed Jul 29, 2026 Full analysis →