# CVE-2026-41146: facil.io and iodine infinite loop in JSON parser

Source: https://junglewise.ai/threats/cve-2026-41146-facil-io-and-iodine-infinite-loop-in-json-parser  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-22. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-41146 · Severity: high · CVSS 4 · Published 2026-04-22

A vulnerability in the facil.io C framework and the iodine Ruby gem can cause web servers to stop responding. When these libraries process a specially crafted JSON message, they enter an infinite loop that consumes 100% of a CPU core. This allows a remote attacker to crash or significantly slow down a service by sending a single malicious request.

Technologies: [Boaz Segev Facil.Io](https://junglewise.ai/threats/technologies/facil-io), [iodine (RubyGems)](https://junglewise.ai/threats/technologies/iodine). Vendors: [Boaz Segev](https://junglewise.ai/threats/vendors/boaz-segev), [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2026-41146 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41146 being exploited in the wild.

**How severe is CVE-2026-41146?** High severity, with a CVSS score of 4, published 22 April 2026.

**Which products and versions are affected?** Boaz Segev Facil.Io <= 0.7.6; iodine (RubyGems) <= 0.7.58, ECOSYSTEM:introduced=0,last_affected=0.7.58.

**Is there a fix for CVE-2026-41146?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-41146 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-41146?** Check whether you run Boaz Segev Facil.Io or iodine (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An uncontrolled resource consumption vulnerability exists in the 'fio_json_parse' function within 'fio_json_parser.h'. The parser fails to advance the read pointer when it encounters a nested JSON value starting with 'i' or 'I' (e.g., '[i' or '[""i'). Specifically, the numeral handling logic incorrectly accepts these characters as integers without consuming any input, causing the parser to loop indefinitely on the same position while 'parser->depth' remains greater than zero. This results in a denial-of-service (DoS) condition where a single worker thread or process pegs a CPU core at 100%. The issue affects facil.io directly and the iodine Ruby gem, which vendors the vulnerable parser code. No official patch was noted in the advisory, though a code-level fix was suggested.

## Affected products

- boazsegev facil.io <= 0.7.6
- boazsegev iodine <= 0.7.58

## Identifiers

- CVE-2026-41146
- GHSA-2x79-gwq3-vxxm

## Timeline

- 2026-04-14: advisory: Original GHSA publication date
- 2026-06-08: other: Advisory updated

## References

- [https://api.github.com/users/michaelknap](https://api.github.com/users/michaelknap)
- [https://github.com/michaelknap](https://github.com/michaelknap)
- [https://api.github.com/users/michaelknap/gists%7B/gist_id%7D](https://api.github.com/users/michaelknap/gists%7B/gist_id%7D)
- [https://api.github.com/users/michaelknap/repos](https://api.github.com/users/michaelknap/repos)
- [https://avatars.githubusercontent.com/u/145442568?v=4](https://avatars.githubusercontent.com/u/145442568?v=4)
- [https://api.github.com/users/michaelknap/events%7B/privacy%7D](https://api.github.com/users/michaelknap/events%7B/privacy%7D)

## Related threats

- [facil.io denial of service in HTTP/1.1 chunked transfer encoding parser](https://junglewise.ai/threats/cve-2026-66731-facil-io-denial-of-service-in-http-1-1-chunked-transfer-encoding)
- [facil.io infinite loop in multipart body parser](https://junglewise.ai/threats/cve-2026-66730-facil-io-infinite-loop-in-multipart-body-parser)
- [facil.io integer underflow in multipart MIME body parser](https://junglewise.ai/threats/cve-2026-66729-facil-io-integer-underflow-in-multipart-mime-body-parser)
- [boazsegev facil.io path traversal in Public Folder Handler](https://junglewise.ai/threats/cve-2026-16653-boazsegev-facil-io-path-traversal-in-public-folder-handler)
- [boazsegev facil.io improper input validation in WebSocket Frame Parser](https://junglewise.ai/threats/cve-2026-16632-boazsegev-facil-io-improper-input-validation-in-websocket-frame)