EUVD-2026-47864
GHSA-5g3v-wh7g-2xvv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated network exploitation with no preconditions; limited CIA impact and no scope change consistent with contained WebSocket parser flaw.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A flaw has been found in boazsegev facil.io up to 0.7.4. Affected is the function websocket_on_protocol_error in the library lib/facil/http/parsers/websocket_parser.h of the component WebSocket Frame Parser. This manipulation of the argument on_message causes improper input validation. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Improper input validation in facil.io's WebSocket Frame Parser (versions up to 0.7.4) allows remote unauthenticated attackers to send crafted WebSocket frames that trigger a flaw in the websocket_on_protocol_error function, yielding limited confidentiality, integrity, and availability impact. A proof-of-concept exploit has been publicly published, lowering the technical barrier for exploitation. The project maintainer was notified via GitHub issue but has not responded, leaving the vulnerability unpatched at time of analysis.
Technical ContextAI
facil.io is a C-based server-side framework designed for building high-performance network and HTTP/WebSocket applications. The vulnerable component is the WebSocket frame parser defined in lib/facil/http/parsers/websocket_parser.h, specifically the websocket_on_protocol_error function. The root cause is CWE-20 (Improper Input Validation): when processing the on_message callback argument during WebSocket protocol error handling, the parser does not adequately validate the input, allowing malformed or attacker-controlled frame data to alter program flow. WebSocket parsers are low-level, performance-sensitive components where strict frame boundary and content validation is required - a gap here can ripple into memory or logic errors depending on how downstream handlers consume the malformed data.
RemediationAI
No vendor-released patch has been identified at time of analysis. The maintainer was notified via GitHub issue #169 (https://github.com/boazsegev/facil.io/issues/169) but has not responded. As a primary compensating control, restrict access to WebSocket endpoints via firewall rules or reverse-proxy ACLs to trusted IP ranges only, which reduces the exposed attack surface without affecting application logic. If WebSocket functionality is not required, disable it at the application or proxy layer - note this may break dependent features. Deploying a WebSocket-aware reverse proxy (such as nginx) in front of facil.io to enforce frame-level validation provides an additional validation layer, though its effectiveness depends on proxy configuration. Organizations should evaluate migration to an actively maintained WebSocket library given the absence of vendor response. Monitor GitHub issue #169 for any maintainer activity.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today