CVE-2026-66754

The record

Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::remove_prefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL. Attackers can send a request whose decoded path matches a configured prefix while the raw percent-encoded path does not, causing the assert! to fail and triggering either a 500 error or full process termination depending on the panic configuration.

Affected packages

Related vulnerabilities

• CVE-2026-119339 Tesseract is an open source OCR engine. CWE-617
• CVE-2026-119139 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a leftover assertion in… CWE-617
• CVE-2026-119142 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service… CWE-617
• CVE-2026-119138 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service… CWE-617
• CVE-2026-119135 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 panics when the host reads a… CWE-617
• CVE-2026-119132 Wasmtime from 49.0.0 before 49.0.3 contains a denial-of-service vulnerability that allows… CWE-617
• CVE-2026-116467 A security flaw has been discovered in ggml-org llama.cpp up to 0.7.0. CWE-617
• CVE-2026-115914 vLLM is an inference and serving engine for large language models. CWE-617