# CVE-2026-16632: boazsegev facil.io improper input validation in WebSocket Frame Parser

Source: https://junglewise.ai/threats/cve-2026-16632-boazsegev-facil-io-improper-input-validation-in-websocket-frame  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-23. Updated: 2026-07-23  
License: CC BY 4.0 with a link back

CVE-2026-16632 · Severity: high · CVSS 7.3 · Published 2026-07-23

facil.io is a high-performance C framework used for building web applications and WebSocket servers. A flaw in its WebSocket parser allows remote attackers to bypass security checks by sending specially crafted data packets that lack mandatory encryption (masking). This can cause the server to process unauthorized commands or data before it realizes the connection is invalid and shuts it down, potentially leading to unintended actions or state changes in the application.

Technologies: [Boaz Segev Facil.Io](https://junglewise.ai/threats/technologies/facil-io). Vendors: [Boaz Segev](https://junglewise.ai/threats/vendors/boaz-segev).

## Quick answers

**Is CVE-2026-16632 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16632 being exploited in the wild.

**How severe is CVE-2026-16632?** High severity, with a CVSS score of 7.3, published 23 July 2026.

**Which products and versions are affected?** Boaz Segev Facil.Io <= 0.7.4.

**Is there a fix for CVE-2026-16632?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-16632 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-16632?** Check whether you run Boaz Segev Facil.Io at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A logic bypass vulnerability exists in the WebSocket frame parser of facil.io up to version 0.7.4. The function `websocket_on_protocol_error` in `lib/facil/http/parsers/websocket_parser.h` correctly identifies unmasked client-to-server frames (which violate RFC 6455), but the parser fails to immediately halt execution. Instead, it continues to the opcode switch statement, delivering the invalid payload to the application's `on_message` callback before the connection is terminated. A remote, unauthenticated attacker can exploit this to execute one application-level action per connection using frames that should have been rejected. As of the advisory date, the project has been informed but no official patch has been released.

## Affected products

- boazsegev facil.io <= 0.7.4

## Timeline

- 2026-06-17: disclosed: Issue reported on GitHub repository
- 2026-07-23: advisory: CVE published by VulDB/NVD

## References

- [https://github.com/boazsegev/facil.io/](https://github.com/boazsegev/facil.io/)
- [https://github.com/boazsegev/facil.io/issues/169](https://github.com/boazsegev/facil.io/issues/169)
- [https://vuldb.com/cve/CVE-2026-16632](https://vuldb.com/cve/CVE-2026-16632)
- [https://vuldb.com/submit/860585](https://vuldb.com/submit/860585)
- [https://vuldb.com/vuln/382382](https://vuldb.com/vuln/382382)
- [https://vuldb.com/vuln/382382/cti](https://vuldb.com/vuln/382382/cti)

## Related threats

- [facil.io denial of service in HTTP/1.1 chunked transfer encoding parser](https://junglewise.ai/threats/cve-2026-66731-facil-io-denial-of-service-in-http-1-1-chunked-transfer-encoding)
- [facil.io infinite loop in multipart body parser](https://junglewise.ai/threats/cve-2026-66730-facil-io-infinite-loop-in-multipart-body-parser)
- [facil.io integer underflow in multipart MIME body parser](https://junglewise.ai/threats/cve-2026-66729-facil-io-integer-underflow-in-multipart-mime-body-parser)
- [boazsegev facil.io path traversal in Public Folder Handler](https://junglewise.ai/threats/cve-2026-16653-boazsegev-facil-io-path-traversal-in-public-folder-handler)
- [facil.io and iodine infinite loop in JSON parser](https://junglewise.ai/threats/cve-2026-41146-facil-io-and-iodine-infinite-loop-in-json-parser)