CVE-2026-16632: facil.io WebSocket Parser RCE Vulnerability

CVE-2026-16632 Overview

CVE-2026-16632 is an improper input validation vulnerability [CWE-20] in the facil.io C web application framework maintained by boazsegev. The flaw resides in the websocket_on_protocol_error function within lib/facil/http/parsers/websocket_parser.h, part of the WebSocket Frame Parser component. Manipulation of the on_message argument triggers improper input validation, which a remote attacker can invoke without authentication or user interaction. A public exploit has been disclosed. The project maintainers were notified through an issue report but have not yet responded, leaving deployed instances without an official patch.

Critical Impact

Remote attackers can trigger the flaw over the network without authentication, affecting confidentiality, integrity, and availability of applications built on facil.io versions up to 0.7.4.

Affected Products

• boazsegev facil.io versions up to and including 0.7.4
• Applications embedding the vulnerable websocket_parser.h header
• WebSocket services built on the facil.io HTTP/WebSocket stack

Discovery Timeline

• 2026-07-23 - CVE-2026-16632 published to NVD
• 2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-16632

Vulnerability Analysis

The vulnerability originates in the WebSocket frame parsing path of facil.io. When a WebSocket protocol error is encountered, the websocket_on_protocol_error function processes the on_message argument without adequate validation of its contents or state. An attacker can craft malformed WebSocket frames that reach this error-handling path with attacker-controlled data. The parser trusts input that should be sanitized or bounds-checked, producing unpredictable behavior in the downstream message dispatch logic. Because facil.io is embedded directly into application binaries as source, every deployment compiled from the affected releases inherits the flaw. The public availability of exploit material increases the likelihood of opportunistic scanning against exposed WebSocket endpoints.

Root Cause

The root cause is improper input validation [CWE-20] in the websocket_on_protocol_error handler. The function does not enforce constraints on the on_message argument before it is used during protocol error processing, allowing malformed input to influence execution.

Attack Vector

Exploitation occurs over the network against any TCP endpoint speaking WebSocket via facil.io. The attacker initiates a WebSocket handshake, then transmits crafted frames that force the parser into the error path with malicious on_message values. No credentials or user interaction are required. See the GitHub issue #169 and the VulDB entry for CVE-2026-16632 for additional technical detail.

Detection Methods for CVE-2026-16632

Indicators of Compromise

• Unexpected process crashes or restarts in services linked against facil.io<= 0.7.4
• WebSocket connections from unfamiliar sources sending malformed frames or protocol-violating opcodes
• Anomalous log entries referencing websocket_on_protocol_error or abrupt WebSocket session terminations

Detection Strategies

• Inventory build artifacts and container images for the websocket_parser.h header sourced from facil.io <= 0.7.4
• Deploy network monitoring rules that flag WebSocket frames violating RFC 6455 framing (reserved bits set, oversized payloads, invalid opcodes)
• Correlate application crash telemetry with inbound WebSocket traffic bursts to identify exploitation attempts

Monitoring Recommendations

• Enable verbose WebSocket protocol logging at reverse proxies fronting facil.io services
• Track sudden spikes in WebSocket close frames with protocol error codes (1002, 1007)
• Alert on repeated connections from single sources that terminate during frame parsing

How to Mitigate CVE-2026-16632

Immediate Actions Required

• Identify all internal and external services built on facil.io <= 0.7.4 and prioritize those exposed to untrusted networks
• Restrict WebSocket endpoints to authenticated users where feasible until a fix is available
• Place a validating reverse proxy or WebSocket-aware WAF in front of facil.io services to reject malformed frames

Patch Information

No vendor patch is available at the time of publication. The maintainer was notified via GitHub issue #169 but has not responded. Monitor the facil.io repository for updated releases beyond 0.7.4 and rebuild affected applications once a fix is committed.

Workarounds

• Terminate WebSocket sessions at an upstream proxy such as nginx or HAProxy that enforces strict RFC 6455 framing before traffic reaches facil.io
• Disable WebSocket functionality in applications where the feature is non-essential
• Apply network ACLs to limit WebSocket endpoint exposure to trusted client ranges
• Consider migrating to an actively maintained WebSocket library if the maintainer remains unresponsive

# Example nginx configuration to front facil.io and enforce timeouts and size limits
location /ws {
    proxy_pass http://facilio_backend;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_read_timeout 30s;
    proxy_send_timeout 30s;
    client_max_body_size 64k;
    limit_req zone=ws_limit burst=10 nodelay;
}