Executive brief
facil.io is a C web framework used to build high-performance web applications. A flaw in how it processes uploaded files and web forms allows an unauthenticated attacker to crash the server by sending a specially crafted request. This can lead to a denial-of-service condition, disrupting business operations and application availability.
Technical details
An integer underflow vulnerability exists in the multipart MIME body parser of facil.io (specifically in http_mime_parser.h) for versions 0.6.0 through 0.7.6. When a multipart/form-data POST request contains a Content-Disposition header with an empty field name (e.g., 'name=;'), the parser calculates a name length of zero. A subsequent check for a closing quote performs a subtraction on this unsigned 32-bit integer, causing a wraparound to 0xFFFFFFFF. This results in an out-of-bounds memory read approximately 4GB past the name pointer, triggering a bus fault and crashing the worker process. The vulnerability can be exploited by a remote, unauthenticated attacker with a single POST request. A fix involves adding a length guard before the pointer decrement.
Affected products
- boazsegev facil.io 0.6.0 through 0.7.6
Timeline
- 2026-07-27: advisory: NVD and VulnCheck published the advisory