# CVE-2026-66729: facil.io integer underflow in multipart MIME body parser

Source: https://junglewise.ai/threats/cve-2026-66729-facil-io-integer-underflow-in-multipart-mime-body-parser  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-27. Updated: 2026-07-27  
License: CC BY 4.0 with a link back

CVE-2026-66729 · Severity: high · CVSS 7.5 · Published 2026-07-27

facil.io is a C web framework used to build high-performance web applications. A flaw in how it processes uploaded files and web forms allows an unauthenticated attacker to crash the server by sending a specially crafted request. This can lead to a denial-of-service condition, disrupting business operations and application availability.

Technologies: [Boaz Segev Facil.Io](https://junglewise.ai/threats/technologies/facil-io). Vendors: [Boaz Segev](https://junglewise.ai/threats/vendors/boaz-segev).

## Quick answers

**Is CVE-2026-66729 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-66729 being exploited in the wild.

**How severe is CVE-2026-66729?** High severity, with a CVSS score of 7.5, published 27 July 2026.

**Which products and versions are affected?** Boaz Segev Facil.Io 0.6.0 through 0.7.6.

**Is there a fix for CVE-2026-66729?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-66729 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-66729?** Check whether you run Boaz Segev Facil.Io at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An integer underflow vulnerability exists in the multipart MIME body parser of facil.io (specifically in http_mime_parser.h) for versions 0.6.0 through 0.7.6. When a multipart/form-data POST request contains a Content-Disposition header with an empty field name (e.g., 'name=;'), the parser calculates a name length of zero. A subsequent check for a closing quote performs a subtraction on this unsigned 32-bit integer, causing a wraparound to 0xFFFFFFFF. This results in an out-of-bounds memory read approximately 4GB past the name pointer, triggering a bus fault and crashing the worker process. The vulnerability can be exploited by a remote, unauthenticated attacker with a single POST request. A fix involves adding a length guard before the pointer decrement.

## Affected products

- boazsegev facil.io 0.6.0 through 0.7.6

## Timeline

- 2026-07-27: advisory: NVD and VulnCheck published the advisory

## References

- [https://github.com/theopaid/Out-of-Bounds-Read-in-facil.io-MIME-Parser-leads-to-Server-Crash](https://github.com/theopaid/Out-of-Bounds-Read-in-facil.io-MIME-Parser-leads-to-Server-Crash)
- [https://www.vulncheck.com/advisories/facil-io-integer-underflow-dos-via-multipart-mime-body-parser](https://www.vulncheck.com/advisories/facil-io-integer-underflow-dos-via-multipart-mime-body-parser)

## Related threats

- [facil.io denial of service in HTTP/1.1 chunked transfer encoding parser](https://junglewise.ai/threats/cve-2026-66731-facil-io-denial-of-service-in-http-1-1-chunked-transfer-encoding)
- [facil.io infinite loop in multipart body parser](https://junglewise.ai/threats/cve-2026-66730-facil-io-infinite-loop-in-multipart-body-parser)
- [boazsegev facil.io path traversal in Public Folder Handler](https://junglewise.ai/threats/cve-2026-16653-boazsegev-facil-io-path-traversal-in-public-folder-handler)
- [boazsegev facil.io improper input validation in WebSocket Frame Parser](https://junglewise.ai/threats/cve-2026-16632-boazsegev-facil-io-improper-input-validation-in-websocket-frame)
- [facil.io and iodine infinite loop in JSON parser](https://junglewise.ai/threats/cve-2026-41146-facil-io-and-iodine-infinite-loop-in-json-parser)