CVE-2026-66729 in facil.io
Summary
by MITRE • 07/27/2026
facil.io 0.6.0 through 0.7.6 contains an integer underflow vulnerability in the multipart MIME body parser that allows unauthenticated remote attackers to crash the server process by sending a crafted Content-Disposition header with an empty field name. Attackers can trigger a uint32_t wraparound in http_mime_parser.h causing an out-of-bounds memory read past the name pointer, resulting in a bus fault that crashes the handling worker with a single POST request.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/27/2026
The facil.io web server framework version 0.6.0 through 0.7.6 contains a critical integer underflow vulnerability that stems from improper input validation within its multipart MIME body parser implementation. This vulnerability exists in the http_mime_parser.h file where a uint32_t variable undergoes an unchecked decrement operation that can cause wraparound behavior when processing malformed Content-Disposition headers. The flaw specifically manifests when attackers craft a malicious Content-Disposition header containing an empty field name, which triggers the vulnerable code path during HTTP request parsing.
The technical execution of this vulnerability relies on the manipulation of multipart form data where the parser attempts to process a field name that is effectively zero-length. When the parser encounters such malformed input, it performs arithmetic operations on unsigned 32-bit integers without proper boundary checks, leading to an integer underflow condition. This underflow causes the uint32_t variable to wrap around to its maximum value, which subsequently results in an out-of-bounds memory access pattern that reads past the allocated buffer boundaries for the name pointer. The memory corruption occurs during the parsing of the multipart MIME structure where the parser assumes valid field length values.
The operational impact of this vulnerability is severe as it allows unauthenticated remote attackers to execute a denial-of-service attack against facil.io servers with minimal effort. An attacker requires only a single crafted POST request containing the malicious Content-Disposition header to trigger the vulnerability and cause the worker process to crash, effectively taking the server component offline. This makes the vulnerability particularly dangerous in production environments where service availability is critical, as it can be exploited by anyone with network access to the affected server without requiring any authentication credentials or advanced privileges.
From a cybersecurity perspective, this vulnerability maps directly to CWE-191 Integer Underflow and aligns with ATT&CK technique T1499.100 (Network Denial of Service) as it enables remote attackers to disrupt service availability through controlled input manipulation. The vulnerability also demonstrates poor defensive programming practices where integer overflow/underflow checks are absent in critical parsing code paths. Organizations using facil.io in their infrastructure should immediately implement mitigations including upgrading to patched versions, implementing request rate limiting, and deploying web application firewalls that can detect and block malformed multipart requests before they reach the vulnerable parser components.
The vulnerability demonstrates a classic security flaw in HTTP request handling where input validation is insufficiently enforced during parsing operations. The integer underflow occurs due to lack of proper bounds checking on unsigned integer arithmetic, which is a well-documented weakness in software development practices. This type of vulnerability is particularly dangerous because it can be triggered remotely without any authentication requirements, making it an attractive target for automated exploitation tools that scan for common web server vulnerabilities across the internet. The crash results in immediate process termination and requires manual intervention or automated restart mechanisms to restore service availability.
Security teams should implement comprehensive monitoring of HTTP request patterns to detect potential exploitation attempts, particularly focusing on multipart form data with unusual Content-Disposition header structures. The vulnerability's impact extends beyond simple service disruption as it can be combined with other techniques to create more sophisticated attack vectors that might lead to information disclosure or further compromise of the affected system. Organizations should also consider implementing additional defensive measures such as request size limits and content-type validation to reduce the attack surface for similar vulnerabilities in their web server configurations.