Skip to main content

Suse CVE-2026-67181

| EUVDEUVD-2026-49890 MEDIUM
HTTP Request/Response Smuggling (CWE-444)
2026-07-28 disclosure@vulncheck.com GHSA-fgf8-ph7p-m275
Request Smuggling Information Disclosure Suse
6.3
CVSS 4.0 · Vendor: vulncheck
Share

Severity by source

Vendor (vulncheck) PRIMARY
6.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
SUSE
5.4 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

1
Analysis Generated
Jul 28, 2026 - 16:43 vuln.today

DescriptionCVE.org

Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize HTTP message boundaries by exploiting improper header forwarding in the proxy implementation. The proxy in src/proxy.rs forwards the client's Transfer-Encoding header to upstream backends unchanged while transmitting a body already de-chunked by tiny_http, enabling CL.TE desynchronization attacks where attackers control where the backend believes the request body ends.

AnalysisAI

HTTP request smuggling vulnerability in Rouille's proxy implementation allows remote attackers to desynchronize HTTP message boundaries using a CL.TE attack. Affected versions 0.3.3 through 3.6.2. Publicly available exploit code exists, but no active exploitation has been reported.

Same weakness CWE-444 – HTTP Request/Response Smuggling

View all
CVE-2023-41265 CRITICAL POC
9.9
CVE-2021-33037 MEDIUM
5.3
CVE-2018-3907 CRITICAL POC
10.0
CVE-2024-10264 CRITICAL POC
9.8
CVE-2022-2466 CRITICAL POC
9.8
CVE-2020-7611 CRITICAL POC
9.8
CVE-2020-10109 CRITICAL POC
9.8
CVE-2020-10108 CRITICAL POC
9.8

Same technique Request Smuggling

View all
CVE-2023-41265 CRITICAL POC
9.9
CVE-2021-33037 MEDIUM
5.3
CVE-2018-3907 CRITICAL POC
10.0
CVE-2024-10264 CRITICAL POC
9.8
CVE-2022-2466 CRITICAL POC
9.8
CVE-2020-7611 CRITICAL POC
9.8
CVE-2020-10109 CRITICAL POC
9.8
CVE-2020-10108 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7 Not-Affected
SUSE Linux Enterprise Server 15 SP7 Not-Affected
SUSE Linux Enterprise Server 16.0 Affected

Share

CVE-2026-67181 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy