Quick answers
- Is CVE-2026-66731 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-66731 being exploited in the wild.
- How severe is CVE-2026-66731?
- High severity, with a CVSS score of 7.5, published 27 July 2026.
- Which products and versions are affected?
- Boaz Segev Facil.Io 0.7.5 through 0.7.6.
- Is there a fix for CVE-2026-66731?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-66731 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-66731?
- Check whether you run Boaz Segev Facil.Io at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A denial-of-service vulnerability exists in the HTTP/1.1 chunked transfer encoding parser of facil.io versions 0.7.5 and 0.7.6. The root cause is located in the http1_atol16 function within http1_parser.h, which incorrectly accepts a leading minus sign for chunk size values. When a negative value is provided, the parser's state machine performs a subtraction that results in a large positive integer, eventually causing the read pointer to move into unmapped memory. An unauthenticated remote attacker can exploit this by sending a single POST request with a 'Transfer-Encoding: chunked' header containing a negative chunk size, leading to a segmentation fault and server crash.
Affected products
- boazsegev facil.io 0.7.5 through 0.7.6
Timeline
- 2026-07-27: advisory: NVD publication date
- 2026-07-27: disclosed: Vulnerability details published by VulnCheck and researcher