CVE-2026-67181

Rouille versions 0.3.3 through 3.6.2 are affected by an HTTP request smuggling vulnerability via the proxy Transfer-Encoding header. The issue arises because the proxy in src/proxy.rs forwards the client’s Transfer-Encoding header to upstream backends unchanged while transmitting a body that has ...