{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/facil.io/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-66731"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["facil.io 0.7.5","facil.io 0.7.6"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","web-vulnerability","facil.io"],"_cs_type":"advisory","_cs_vendors":["facil.io"],"content_html":"\u003cp\u003eA significant denial-of-service vulnerability, identified as CVE-2026-66731, has been discovered in the \u003ccode\u003efacil.io\u003c/code\u003e web application framework, specifically affecting versions 0.7.5 and 0.7.6. This vulnerability resides within the HTTP/1.1 chunked transfer encoding parser, located in \u003ccode\u003ehttp1_parser.h\u003c/code\u003e. Unauthenticated remote attackers can exploit this flaw by sending a specially crafted POST request. The request must include a \u003ccode\u003eTransfer-Encoding: chunked\u003c/code\u003e header with a chunk size value preceded by a minus sign. When processed, this negative value is erroneously converted into a very large positive integer by the parser. This incorrect interpretation corrupts the server's internal state, leading to attempts to access unmapped memory and subsequently causing the server process to crash. This vulnerability poses a direct threat to the availability of applications built with the affected \u003ccode\u003efacil.io\u003c/code\u003e versions.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated remote attacker identifies a web server running an application built with a vulnerable version of \u003ccode\u003efacil.io\u003c/code\u003e (0.7.5 or 0.7.6).\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious HTTP POST request targeting the vulnerable server.\u003c/li\u003e\n\u003cli\u003eThe crafted request includes the HTTP header \u003ccode\u003eTransfer-Encoding: chunked\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eWithin the body of the chunked transfer encoding, the attacker inserts a chunk size value that begins with a minus sign (e.g., \u003ccode\u003e-1\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003efacil.io\u003c/code\u003e HTTP/1.1 chunked transfer encoding parser (located in \u003ccode\u003ehttp1_parser.h\u003c/code\u003e) attempts to process this malformed chunk size.\u003c/li\u003e\n\u003cli\u003eDue to a flaw in the parser's logic, the negative chunk size is incorrectly converted into a large positive integer value.\u003c/li\u003e\n\u003cli\u003eThis erroneous interpretation corrupts the internal memory management state of the \u003ccode\u003efacil.io\u003c/code\u003e server process.\u003c/li\u003e\n\u003cli\u003eThe server process attempts to access unmapped memory locations, leading to a segmentation fault and ultimately crashing the server, resulting in a denial-of-service.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-66731 results in a complete denial-of-service (DoS) for any application running on affected \u003ccode\u003efacil.io\u003c/code\u003e servers. Attackers can repeatedly crash the server with minimal effort, rendering services unavailable to legitimate users. While no specific victim counts or targeted sectors are mentioned, any organization utilizing \u003ccode\u003efacil.io\u003c/code\u003e versions 0.7.5 or 0.7.6 for their web applications is at risk. The direct consequence is service disruption, which can lead to significant operational losses, reputational damage, and potential financial impact for affected organizations. The vulnerability requires no authentication, making it particularly easy to exploit remotely.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-66731 by updating \u003ccode\u003efacil.io\u003c/code\u003e to a version beyond 0.7.6, as soon as a fix is available, on all affected servers immediately.\u003c/li\u003e\n\u003cli\u003eImplement Web Application Firewalls (WAFs) or intrusion prevention systems (IPS) to detect and block malformed HTTP requests, especially those with unusual \u003ccode\u003eTransfer-Encoding\u003c/code\u003e header content.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-27T17:19:30Z","date_published":"2026-07-27T17:19:30Z","id":"https://feed.craftedsignal.io/briefs/2026-07-facil-io-dos/","summary":"An unauthenticated remote denial-of-service vulnerability exists in facil.io versions 0.7.5 through 0.7.6, allowing attackers to crash the server by sending a POST request with a 'Transfer-Encoding: chunked' header containing a negative chunk size value, which corrupts internal state and leads to a fault.","title":"Denial-of-Service Vulnerability in facil.io HTTP/1.1 Chunked Transfer Encoding Parser (CVE-2026-66731)","url":"https://feed.craftedsignal.io/briefs/2026-07-facil-io-dos/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-66730"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["facil.io 0.6.0 through 0.7.6"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","vulnerability","web-server"],"_cs_type":"advisory","_cs_vendors":["facil.io"],"content_html":"\u003cp\u003eCVE-2026-66730 identifies a critical denial-of-service vulnerability affecting facil.io, a C web framework, specifically in versions 0.6.0 through 0.7.6. An unauthenticated remote attacker can exploit this flaw in the multipart body parser by sending a specially crafted \u003ccode\u003emultipart/form-data\u003c/code\u003e request. The core issue lies with a missing progress guard within the parser loop (\u003ccode\u003ehttp_mime_parse\u003c/code\u003e), which causes it to return zero bytes consumed without setting error or completion flags when encountering a partial closing boundary. This results in the calling loop re-invoking the parser indefinitely on the same buffer, leading to all worker processes consuming 100% CPU and permanently freezing the server, rendering the web service entirely unavailable until a manual restart. This vulnerability poses a significant risk to the availability of applications built with the affected facil.io versions.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated remote attacker identifies a web server running a vulnerable version of facil.io (0.6.0 to 0.7.6).\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious HTTP POST request with the \u003ccode\u003eContent-Type\u003c/code\u003e header set to \u003ccode\u003emultipart/form-data\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe request body is intentionally malformed, including a partial closing boundary for the multipart data.\u003c/li\u003e\n\u003cli\u003eUpon receiving the request, the facil.io server routes it to its multipart body parser (\u003ccode\u003ehttp_mime_parse\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe parser attempts to process the malformed boundary but, due to a missing progress guard, fails to advance or signal an error.\u003c/li\u003e\n\u003cli\u003eThe calling loop repeatedly invokes the parser with the same buffer, causing an infinite loop within the worker process.\u003c/li\u003e\n\u003cli\u003eThe affected worker process consumes 100% of its CPU resources and becomes permanently frozen.\u003c/li\u003e\n\u003cli\u003eAll available worker processes eventually become similarly frozen, leading to a complete denial of service for the web application, requiring a manual server restart to restore functionality.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-66730 results in a complete and sustained denial-of-service condition for the affected facil.io web server. All worker processes are permanently locked into an infinite loop, exhausting CPU resources and making the server unresponsive to legitimate requests. This directly translates to significant downtime for any web application or service relying on the vulnerable facil.io instance, necessitating manual intervention and restart, leading to operational disruptions and potential financial losses due to service unavailability. The vulnerability is easily triggered remotely without authentication.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-66730 immediately by upgrading facil.io to version 0.7.7 or later to address the vulnerability.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for repeated or unusual \u003ccode\u003ePOST\u003c/code\u003e requests to application endpoints, especially those with \u003ccode\u003eContent-Type: multipart/form-data\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eImplement rate limiting or web application firewall (WAF) rules to detect and block suspicious \u003ccode\u003emultipart/form-data\u003c/code\u003e requests with malformed boundaries, referencing CVE-2026-66730.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-27T17:18:50Z","date_published":"2026-07-27T17:18:50Z","id":"https://feed.craftedsignal.io/briefs/2026-07-facilio-dos/","summary":"A denial-of-service vulnerability exists in facil.io versions 0.6.0 through 0.7.6, specifically in its multipart body parser, allowing an unauthenticated remote attacker to permanently freeze worker processes at 100% CPU by sending a malformed multipart/form-data request with a partial closing boundary, effectively disabling the server until manual restart.","title":"CVE-2026-66730 Denial of Service in facil.io Multipart Body Parser","url":"https://feed.craftedsignal.io/briefs/2026-07-facilio-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Facil.io","version":"https://jsonfeed.org/version/1.1"}