Executive brief
A vulnerability in the facil.io web application framework allows an attacker to crash a server remotely. By sending a specially crafted web request, an attacker can trigger a memory error that forces the application to shut down. This results in a denial-of-service, making the affected website or service unavailable to legitimate users.
Technical details
A denial-of-service vulnerability exists in the HTTP/1.1 chunked transfer encoding parser of facil.io versions 0.7.5 and 0.7.6. The root cause is located in the http1_atol16 function within http1_parser.h, which incorrectly accepts a leading minus sign for chunk size values. When a negative value is provided, the parser's state machine performs a subtraction that results in a large positive integer, eventually causing the read pointer to move into unmapped memory. An unauthenticated remote attacker can exploit this by sending a single POST request with a 'Transfer-Encoding: chunked' header containing a negative chunk size, leading to a segmentation fault and server crash.
Affected products
- boazsegev facil.io 0.7.5 through 0.7.6
Timeline
- 2026-07-27: advisory: NVD publication date
- 2026-07-27: disclosed: Vulnerability details published by VulnCheck and researcher