EUVD-2026-49358
GHSA-g2qx-6r8w-37px
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
facil.io through 0.7.6 contains an integer underflow vulnerability in the multipart MIME body parser that allows unauthenticated remote attackers to crash the server process by sending a crafted Content-Disposition header with an empty field name. Attackers can trigger a uint32_t wraparound in http_mime_parser.h causing an out-of-bounds memory read past the name pointer, resulting in a bus fault that crashes the handling worker with a single POST request.
AnalysisAI
Remote denial-of-service in facil.io through version 0.7.6 allows unauthenticated attackers to crash worker processes by sending a crafted POST request with an empty Content-Disposition header field name. A public proof-of-concept exploit exists. The integer underflow in http_mime_parser.h causes an out-of-bounds memory read and bus fault, resulting in immediate server disruption.
Denial-of-service in facil.io HTTP/1.1 chunked transfer encoding parser allows remote unauthenticated attackers to crash
Denial-of-service in facil.io 0.6.0 through 0.7.6 permits unauthenticated remote attackers to permanently disable the se
Path traversal in boazsegev facil.io up to version 0.7.58 allows remote unauthenticated attackers to read files outside
Remote unauthenticated denial of service affects facil.io (all versions prior to commit 5128747) and iodine (all version
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today