Rouille 0.3.3 through 3.6.2 contains a vulnerability that allows remote attackers to desynchronize HTTP message boundaries by forwarding the client’s Transfer‑Encoding header unchanged while the body has already been de‑chunked. This corruption enables CL.TE desynchronization attacks, giving an attacker control over where the backend server believes the request body ends and opening the door to request smuggling scenarios such as hidden or duplicated requests, which can lead to data leakage or unauthorized actions on the server.

The vulnerable product is the Rouille HTTP library released by the tomaka project. All releases from 0.3.3 up through 3.6.2 are affected; any software incorporating these versions and using the proxy functionality in src/proxy.rs is at risk.

The CVSS score of 6.3 indicates a moderate severity. The EPSS score is less than 1%, suggesting that exploitation attempts are currently rare. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw from the network by sending a crafted request with a Transfer‑Encoding header to the proxy; no authentication or local access is required. Because the flaw relies on standard proxy behavior, it can be triggered against any upstream backend without additional configuration. The exploit risk is thus limited by the low probability of exploitation but remains a concern for exposed proxies.