# CVE-2026-66731: facil.io denial of service in HTTP/1.1 chunked transfer encoding parser

Source: https://junglewise.ai/threats/cve-2026-66731-facil-io-denial-of-service-in-http-1-1-chunked-transfer-encoding  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-27. Updated: 2026-07-27  
License: CC BY 4.0 with a link back

CVE-2026-66731 · Severity: high · CVSS 7.5 · Published 2026-07-27

A vulnerability in the facil.io web application framework allows an attacker to crash a server remotely. By sending a specially crafted web request, an attacker can trigger a memory error that forces the application to shut down. This results in a denial-of-service, making the affected website or service unavailable to legitimate users.

Technologies: [Boaz Segev Facil.Io](https://junglewise.ai/threats/technologies/facil-io). Vendors: [Boaz Segev](https://junglewise.ai/threats/vendors/boaz-segev).

## Quick answers

**Is CVE-2026-66731 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-66731 being exploited in the wild.

**How severe is CVE-2026-66731?** High severity, with a CVSS score of 7.5, published 27 July 2026.

**Which products and versions are affected?** Boaz Segev Facil.Io 0.7.5 through 0.7.6.

**Is there a fix for CVE-2026-66731?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-66731 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-66731?** Check whether you run Boaz Segev Facil.Io at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A denial-of-service vulnerability exists in the HTTP/1.1 chunked transfer encoding parser of facil.io versions 0.7.5 and 0.7.6. The root cause is located in the http1_atol16 function within http1_parser.h, which incorrectly accepts a leading minus sign for chunk size values. When a negative value is provided, the parser's state machine performs a subtraction that results in a large positive integer, eventually causing the read pointer to move into unmapped memory. An unauthenticated remote attacker can exploit this by sending a single POST request with a 'Transfer-Encoding: chunked' header containing a negative chunk size, leading to a segmentation fault and server crash.

## Affected products

- boazsegev facil.io 0.7.5 through 0.7.6

## Timeline

- 2026-07-27: advisory: NVD publication date
- 2026-07-27: disclosed: Vulnerability details published by VulnCheck and researcher

## References

- [https://github.com/theopaid/Negative-Chunk-Size-Parsing-Causes-Memory-Corruption-in-facil.io-leading-to-Server-Crash](https://github.com/theopaid/Negative-Chunk-Size-Parsing-Causes-Memory-Corruption-in-facil.io-leading-to-Server-Crash)
- [https://www.vulncheck.com/advisories/facil-io-http-chunked-transfer-encoding-parser-crash-dos](https://www.vulncheck.com/advisories/facil-io-http-chunked-transfer-encoding-parser-crash-dos)

## Related threats

- [facil.io infinite loop in multipart body parser](https://junglewise.ai/threats/cve-2026-66730-facil-io-infinite-loop-in-multipart-body-parser)
- [facil.io integer underflow in multipart MIME body parser](https://junglewise.ai/threats/cve-2026-66729-facil-io-integer-underflow-in-multipart-mime-body-parser)
- [boazsegev facil.io path traversal in Public Folder Handler](https://junglewise.ai/threats/cve-2026-16653-boazsegev-facil-io-path-traversal-in-public-folder-handler)
- [boazsegev facil.io improper input validation in WebSocket Frame Parser](https://junglewise.ai/threats/cve-2026-16632-boazsegev-facil-io-improper-input-validation-in-websocket-frame)
- [facil.io and iodine infinite loop in JSON parser](https://junglewise.ai/threats/cve-2026-41146-facil-io-and-iodine-infinite-loop-in-json-parser)