Boazsegev
Monthly
Denial-of-service in facil.io HTTP/1.1 chunked transfer encoding parser allows remote unauthenticated attackers to crash the server by sending a negative chunk size. Affected versions 0.7.5 through 0.7.6; a public proof-of-concept exploit exists, but no active exploitation (not in CISA KEV) is confirmed. Attackers can trigger the vulnerability without authentication, causing an out-of-bounds read and server crash.
Denial-of-service in facil.io 0.6.0 through 0.7.6 permits unauthenticated remote attackers to permanently disable the server by sending a specially crafted multipart/form-data request with a partial closing boundary. The flaw triggers an infinite loop in the multipart parser, consuming 100% CPU on all worker processes and requiring a manual restart to recover. A public proof-of-concept is available, though no active exploitation has been confirmed by CISA KEV.
Remote denial-of-service in facil.io through version 0.7.6 allows unauthenticated attackers to crash worker processes by sending a crafted POST request with an empty Content-Disposition header field name. A public proof-of-concept exploit exists. The integer underflow in http_mime_parser.h causes an out-of-bounds memory read and bus fault, resulting in immediate server disruption.
Remote unauthenticated denial of service affects facil.io (all versions prior to commit 5128747) and iodine (all versions before 0.7.59) through malformed JSON input triggering infinite CPU loop. Attackers can send crafted JSON payloads as small as two bytes ('[i') to the `fio_json_parse` function, causing the process to consume 100% of a CPU core indefinitely without crashing or returning an error. This vulnerability allows trivial resource exhaustion against any web service using these frameworks to parse untrusted JSON. EPSS data not available; no confirmed active exploitation (CISA KEV absent), but the attack requires only network access with no authentication and minimal complexity (CVSS AV:N/AC:L/PR:N), making exploitation straightforward once discovered.
Path traversal in boazsegev facil.io up to version 0.7.58 allows remote unauthenticated attackers to read files outside the configured web root by supplying crafted traversal sequences to the `http_sendfile2` function in the Public Folder Handler. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no authentication and no special setup beyond a running facil.io instance with static file serving enabled. A public exploit has been released and the vendor has not responded to the responsible disclosure, leaving all known versions unpatched at time of analysis.
Path traversal in the static file service in Iodine less than 0.7.33 allows an unauthenticated, remote attacker to read files outside the public folder via malicious URLs. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Denial-of-service in facil.io HTTP/1.1 chunked transfer encoding parser allows remote unauthenticated attackers to crash the server by sending a negative chunk size. Affected versions 0.7.5 through 0.7.6; a public proof-of-concept exploit exists, but no active exploitation (not in CISA KEV) is confirmed. Attackers can trigger the vulnerability without authentication, causing an out-of-bounds read and server crash.
Denial-of-service in facil.io 0.6.0 through 0.7.6 permits unauthenticated remote attackers to permanently disable the server by sending a specially crafted multipart/form-data request with a partial closing boundary. The flaw triggers an infinite loop in the multipart parser, consuming 100% CPU on all worker processes and requiring a manual restart to recover. A public proof-of-concept is available, though no active exploitation has been confirmed by CISA KEV.
Remote denial-of-service in facil.io through version 0.7.6 allows unauthenticated attackers to crash worker processes by sending a crafted POST request with an empty Content-Disposition header field name. A public proof-of-concept exploit exists. The integer underflow in http_mime_parser.h causes an out-of-bounds memory read and bus fault, resulting in immediate server disruption.
Remote unauthenticated denial of service affects facil.io (all versions prior to commit 5128747) and iodine (all versions before 0.7.59) through malformed JSON input triggering infinite CPU loop. Attackers can send crafted JSON payloads as small as two bytes ('[i') to the `fio_json_parse` function, causing the process to consume 100% of a CPU core indefinitely without crashing or returning an error. This vulnerability allows trivial resource exhaustion against any web service using these frameworks to parse untrusted JSON. EPSS data not available; no confirmed active exploitation (CISA KEV absent), but the attack requires only network access with no authentication and minimal complexity (CVSS AV:N/AC:L/PR:N), making exploitation straightforward once discovered.
Path traversal in boazsegev facil.io up to version 0.7.58 allows remote unauthenticated attackers to read files outside the configured web root by supplying crafted traversal sequences to the `http_sendfile2` function in the Public Folder Handler. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no authentication and no special setup beyond a running facil.io instance with static file serving enabled. A public exploit has been released and the vendor has not responded to the responsible disclosure, leaving all known versions unpatched at time of analysis.
Path traversal in the static file service in Iodine less than 0.7.33 allows an unauthenticated, remote attacker to read files outside the public folder via malicious URLs. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.