facil.io CVE-2026-41146

Successful exploitation requires the target application to invoke the vulnerable fio_json_parse function on attacker-controlled JSON input. This occurs in any facil.io or iodine web service that accepts JSON in HTTP request bodies, WebSocket messages, or other network-sourced data streams. No special server configuration, authentication, or non-default features are required-the vulnerability exists in default facil.io and iodine installations processing JSON. The attack works against any deployment accepting network connections (AV:N) and requires no user interaction (UI:N) or privileges (PR:N). Exploitation is NOT limited by: authentication mechanisms (affects public and authenticated endpoints equally), TLS/encryption status (attack payload is valid at application layer), or specific HTTP methods (POST, PUT, PATCH all viable). The only practical limitation is that the target service must actually parse the JSON payload rather than rejecting it at an earlier validation layer (reverse proxy, WAF, input schema validation).

The CVSS v4.0 score of 8.7 accurately reflects high real-world risk due to the combination of network-accessible attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction needed (UI:N), and high availability impact (VA:H). The vulnerability enables trivial denial-of-service attacks: a single two-byte HTTP request can pin a CPU core at maximum utilization, and multiple requests can exhaust all CPU resources on the target server. The attack is highly automatable and requires no special conditions beyond the target application accepting JSON input. While CVSS indicates no confidentiality or integrity impact (VC:N, VI:N), the availability disruption can be severe for production services. The absence of EPSS scoring and CISA KEV listing suggests no widespread exploitation campaigns have been observed, but the extremely low barrier to exploitation (publicly documented minimal reproducer in GitHub advisory) means defenders should treat this as a priority for internet-facing services. The SSVC decision framework would classify this as exploitation=none (no evidence of active use), automatable=yes (trivial scripting), and technical impact=partial (availability only), suggesting organizations should apply fixes in normal patching cycles unless the service handles untrusted public JSON at scale.

An attacker sends an HTTP POST request to a facil.io or iodine web service endpoint that accepts JSON input, with the minimal payload '[i' in the request body. The application invokes fio_json_parse on the untrusted input, and the parser enters an infinite loop when attempting to process the 'i' token in nested context. The worker process consumes 100% of one CPU core indefinitely without returning an error or crashing. By sending multiple concurrent requests (10-50 depending on server core count), the attacker exhausts all CPU resources, rendering the service unresponsive to legitimate users. Publicly available exploit code exists in the form of the documented minimal reproducer in the GitHub advisory.