CVE-2026-66754

CVE-2026-66754 in the Rouille web framework reveals a logic mismatch rather than a memory safety flaw. The library's routing layer normalizes URL paths (decodes percent-encoded characters) when making prefix-matching decisions, but the `remove_prefix` validation function checks against raw, unnormalized paths. This creates an inconsistency: a path like `/%61dmin` (which decodes to `/admin`) will match the routing prefix `/admin`, but `remove_prefix` sees `/%61dmin` and fails the check, triggering an assertion that crashes the server. This is unusual because Rust assertions are meant to catch programmer errors in invariant states—not conditions an external attacker can reliably control. The fact that this is exploitable means someone added `remove_prefix` with different normalization assumptions than the routing layer. The attack surface is substantial: any percent-encoded character in a request path that decodes to a character matching a configured prefix will trigger the crash. The operational impact depends heavily on your panic configuration. If the server terminates on panic (the default), this is a denial-of-service with immediate visibility—someone gets paged, the site goes down, the vulnerability becomes known quickly. If the server catches panics and returns a 500 error, the vulnerability becomes a silent denial-of-service that looks like a normal server error. No one gets paged, no incident is declared, and the bug persists unaddressed. Two things to verify immediately: First, check whether Rouille is running behind a process supervisor (like systemd or a container orchestrator) that will restart it on crash—if not, a single crafted request can take down the entire service. Second, examine whether other path-handling functions in your Rouille version perform similar dual-path processing. The fix in the patch either normalized both sides of the comparison (the proper fix) or replaced the assertion with error handling (which masks the symptom but leaves the underlying inconsistency intact). If it's the latter, audit other Request methods for related logic mismatches that could produce authorization bypasses rather than crashes.

Reviewed through automated stages and approved by a human before publication.