boazsegev facil.io/iodine JSON fio_json_parse resource consumption

Summaryinfo

A vulnerability, which was classified as problematic, has been found in boazsegev facil.io and iodine. Affected by this vulnerability is the function fio_json_parse of the component JSON Handler. Performing a manipulation results in resource consumption. This vulnerability is identified as CVE-2026-41146. The attack can be initiated remotely. There is not any exploit available. To fix this issue, it is recommended to deploy a patch.

Detailsinfo

A vulnerability was found in boazsegev facil.io and iodine (affected version unknown). It has been classified as problematic. This affects the function fio_json_parse of the component JSON Handler. The manipulation with an unknown input leads to a resource consumption vulnerability. CWE is classifying the issue as CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. This is going to have an impact on availability. The summary by CVE is:

facil.io is a C micro-framework for web applications. Prior to commit 5128747363055201d3ecf0e29bf0a961703c9fa0, `fio_json_parse` can enter an infinite loop when it encounters a nested JSON value starting with `i` or `I`. The process spins in user space and pegs one CPU core at ~100% instead of returning a parse error. Because `iodine` vendors the same parser code, the issue also affects `iodine` when it parses attacker-controlled JSON. The smallest reproducer I found is `[i`. The quoted-value form that originally exposed the issue, `[""i`, reaches the same bug because the parser tolerates missing commas and then treats the trailing `i` as the start of another value. Commit 5128747363055201d3ecf0e29bf0a961703c9fa0 fixes the issue.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-41146 since 04/17/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

Applying the patch 5128747363055201d3ecf0e29bf0a961703c9fa0 is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-24583). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• boazsegev

Name

• facil.io
• iodine

License

• open-source

Website

• Product: https://github.com/boazsegev/facil.io/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion