CVE-2026-41146
HighSummary
facil.io prior to commit 5128747363055201d3ecf0e29bf0a961703c9fa0 has an infinite loop vulnerability in `fio_json_parse` when encountering a nested JSON value starting with 'i' or 'I'. The process spins in user space and pegs one CPU core at ~100% instead of returning a parse error. Because `iodine` vendors the same parser code, it is also affected.
Risk Assessment
The risk includes a DoS attack via CPU exhaustion, potentially leading to service unavailability for other users.
Recommendation
Upgrade facil.io to a version containing the fix (commit 5128747363055201d3ecf0e29bf0a961703c9fa0) and update `iodine` if used. Also restrict processing of untrusted JSON data.
Other vulnerabilities in facil.io
See all- CVE-2026-66731High
A denial-of-service vulnerability in facil.io 0.7.5 through 0.7.6 in the HTTP/1.1 chunked transfer encoding parser allows unauthenticated remote attackers to crash the server by sending a negative chunk size value, causing memory corruption and a fault.
- CVE-2026-66730High
A denial-of-service vulnerability in facil.io 0.6.0 through 0.7.6 in the multipart body parser allows unauthenticated remote attackers to permanently freeze worker processes at 100% CPU by sending a multipart/form-data request with a partial closing boundary, exhausting all workers and disabling the server until manual restart.
- CVE-2026-66729High
facil.io versions 0.6.0 through 0.7.6 contain an integer underflow vulnerability in the multipart MIME body parser that allows unauthenticated remote attackers to crash the server process by sending a crafted Content-Disposition header with an empty field name. Attackers can trigger a uint32_t wraparound in http_mime_parser.h causing an out-of-bounds memory read past the name pointer, resulting in a bus fault that crashes the handling worker with a single POST request.
- CVE-2026-16653Medium
A path traversal vulnerability exists in boazsegev facil.io up to version 0.7.58 in the http_sendfile2 function of the Public Folder Handler component. Remote exploitation is possible and the exploit has been released.
- CVE-2026-16632High
In the facil.io library up to version 0.7.4, a vulnerability was found in the websocket_on_protocol_error function in websocket_parser.h. Manipulation of the on_message argument leads to improper input validation, which can be exploited remotely. The project has not responded to the issue report.
Original NVD description (English source)
facil.io is a C micro-framework for web applications. Prior to commit 5128747363055201d3ecf0e29bf0a961703c9fa0, `fio_json_parse` can enter an infinite loop when it encounters a nested JSON value starting with `i` or `I`. The process spins in user space and pegs one CPU core at ~100% instead of returning a parse error. Because `iodine` vendors the same parser code, the issue also affects `iodine` when it parses attacker-controlled JSON. The smallest reproducer I found is `[i`. The quoted-value form that originally exposed the issue, `[""i`, reaches the same bug because the parser tolerates missing commas and then treats the trailing `i` as the start of another value. Commit 5128747363055201d3ecf0e29bf0a961703c9fa0 fixes the issue.