Skip to content
OpenAdvisories
High · 7.5 Public exploit CVE-2026-66729 EUVD-2026-49358GHSA-g2qx-6r8w-37px

facil.io 0.6.0 - 0.7.6 Integer Underflow DoS via Multipart MIME Body Parser

Published Jul 27, 2026 · Updated Jul 31, 2026 · Assigned by VulnCheck

Vendor: boazsegev Product: facil.io

Description

facil.io 0.6.0 through 0.7.6 contains an integer underflow vulnerability in the multipart MIME body parser that allows unauthenticated remote attackers to crash the server process by sending a crafted Content-Disposition header with an empty field name. Attackers can trigger a uint32_t wraparound in http_mime_parser.h causing an out-of-bounds memory read past the name pointer, resulting in a bus fault that crashes the handling worker with a single POST request.

Affected products

VendorProductAffectedFixed
boazsegev facil.io 0.6.0 – ≤ 0.7.6 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References