{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/facil.io-0.6.0-through-0.7.6/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-66730"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["facil.io 0.6.0 through 0.7.6"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","vulnerability","web-server"],"_cs_type":"advisory","_cs_vendors":["facil.io"],"content_html":"\u003cp\u003eCVE-2026-66730 identifies a critical denial-of-service vulnerability affecting facil.io, a C web framework, specifically in versions 0.6.0 through 0.7.6. An unauthenticated remote attacker can exploit this flaw in the multipart body parser by sending a specially crafted \u003ccode\u003emultipart/form-data\u003c/code\u003e request. The core issue lies with a missing progress guard within the parser loop (\u003ccode\u003ehttp_mime_parse\u003c/code\u003e), which causes it to return zero bytes consumed without setting error or completion flags when encountering a partial closing boundary. This results in the calling loop re-invoking the parser indefinitely on the same buffer, leading to all worker processes consuming 100% CPU and permanently freezing the server, rendering the web service entirely unavailable until a manual restart. This vulnerability poses a significant risk to the availability of applications built with the affected facil.io versions.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated remote attacker identifies a web server running a vulnerable version of facil.io (0.6.0 to 0.7.6).\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious HTTP POST request with the \u003ccode\u003eContent-Type\u003c/code\u003e header set to \u003ccode\u003emultipart/form-data\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe request body is intentionally malformed, including a partial closing boundary for the multipart data.\u003c/li\u003e\n\u003cli\u003eUpon receiving the request, the facil.io server routes it to its multipart body parser (\u003ccode\u003ehttp_mime_parse\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe parser attempts to process the malformed boundary but, due to a missing progress guard, fails to advance or signal an error.\u003c/li\u003e\n\u003cli\u003eThe calling loop repeatedly invokes the parser with the same buffer, causing an infinite loop within the worker process.\u003c/li\u003e\n\u003cli\u003eThe affected worker process consumes 100% of its CPU resources and becomes permanently frozen.\u003c/li\u003e\n\u003cli\u003eAll available worker processes eventually become similarly frozen, leading to a complete denial of service for the web application, requiring a manual server restart to restore functionality.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-66730 results in a complete and sustained denial-of-service condition for the affected facil.io web server. All worker processes are permanently locked into an infinite loop, exhausting CPU resources and making the server unresponsive to legitimate requests. This directly translates to significant downtime for any web application or service relying on the vulnerable facil.io instance, necessitating manual intervention and restart, leading to operational disruptions and potential financial losses due to service unavailability. The vulnerability is easily triggered remotely without authentication.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-66730 immediately by upgrading facil.io to version 0.7.7 or later to address the vulnerability.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for repeated or unusual \u003ccode\u003ePOST\u003c/code\u003e requests to application endpoints, especially those with \u003ccode\u003eContent-Type: multipart/form-data\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eImplement rate limiting or web application firewall (WAF) rules to detect and block suspicious \u003ccode\u003emultipart/form-data\u003c/code\u003e requests with malformed boundaries, referencing CVE-2026-66730.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-27T17:18:50Z","date_published":"2026-07-27T17:18:50Z","id":"https://feed.craftedsignal.io/briefs/2026-07-facilio-dos/","summary":"A denial-of-service vulnerability exists in facil.io versions 0.6.0 through 0.7.6, specifically in its multipart body parser, allowing an unauthenticated remote attacker to permanently freeze worker processes at 100% CPU by sending a malformed multipart/form-data request with a partial closing boundary, effectively disabling the server until manual restart.","title":"CVE-2026-66730 Denial of Service in facil.io Multipart Body Parser","url":"https://feed.craftedsignal.io/briefs/2026-07-facilio-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Facil.io 0.6.0 Through 0.7.6","version":"https://jsonfeed.org/version/1.1"}