Rouille between versions 0.1.6 and 3.6.2 contains a reachable assertion flaw in the Request::remove_prefix routine. The assertion can be triggered when a request carries a percent‑encoded path that, after decoding, matches a configured prefix while the raw percent‑encoded form does not. When the assert! fails the routine either returns a 500 internal server error or causes the process to terminate depending on the panic configuration, thereby causing a denial of service.

The affected product is the Rouille HTTP library developed by tomaka. All releases from 0.1.6 through 3.6.2 are affected. Users employing these versions in server‑side applications are susceptible to the vulnerability.

The CVSS score of 8.2 classifies the issue as high severity. The EPSS score of less than 1% indicates a low likelihood of exploitation under current conditions, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, the flaw is remotely exploitable without authentication and can be triggered by sending a single crafted percent‑encoded URL request to the server. Successful exploitation results in a service interruption via a 500 error or complete process termination depending on the server’s panic handling.