Quick answers
- Is CVE-2026-66729 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-66729 being exploited in the wild.
- How severe is CVE-2026-66729?
- High severity, with a CVSS score of 7.5, published 27 July 2026.
- Which products and versions are affected?
- Boaz Segev Facil.Io 0.6.0 through 0.7.6.
- Is there a fix for CVE-2026-66729?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-66729 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-66729?
- Check whether you run Boaz Segev Facil.Io at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An integer underflow vulnerability exists in the multipart MIME body parser of facil.io (specifically in http_mime_parser.h) for versions 0.6.0 through 0.7.6. When a multipart/form-data POST request contains a Content-Disposition header with an empty field name (e.g., 'name=;'), the parser calculates a name length of zero. A subsequent check for a closing quote performs a subtraction on this unsigned 32-bit integer, causing a wraparound to 0xFFFFFFFF. This results in an out-of-bounds memory read approximately 4GB past the name pointer, triggering a bus fault and crashing the worker process. The vulnerability can be exploited by a remote, unauthenticated attacker with a single POST request. A fix involves adding a length guard before the pointer decrement.
Affected products
- boazsegev facil.io 0.6.0 through 0.7.6
Timeline
- 2026-07-27: advisory: NVD and VulnCheck published the advisory