CVE-2026-66729: facil.io Integer Underflow DoS Vulnerability

CVE-2026-66729 Overview

CVE-2026-66729 is an integer underflow vulnerability in the facil.io C web framework, affecting versions 0.6.0 through 0.7.6. The flaw resides in the multipart MIME body parser located in http_mime_parser.h. An unauthenticated remote attacker can send a single crafted Content-Disposition header containing an empty field name to trigger a uint32_t wraparound. The wraparound causes an out-of-bounds memory read past the name pointer, producing a bus fault that terminates the handling worker process. The issue is tracked under CWE-125: Out-of-Bounds Read.

Critical Impact
A single unauthenticated HTTP POST request crashes the facil.io worker process, enabling remote denial-of-service against exposed applications.

Affected Products

facil.io 0.6.0 through 0.7.6
Applications and services embedding the vulnerable http_mime_parser.h component
HTTP endpoints accepting multipart/form-data POST requests

Discovery Timeline

2026-07-27 - CVE-2026-66729 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-66729

Vulnerability Analysis

The vulnerability exists in the multipart MIME body parser used by facil.io to process multipart/form-data HTTP request bodies. When the parser processes a Content-Disposition header field, it computes the length of the name field using unsigned 32-bit arithmetic. Supplying an empty name causes the length computation to underflow to a value near UINT32_MAX.

The parser then uses the corrupted length value to read bytes past the intended buffer boundary. The resulting out-of-bounds read walks into unmapped memory and produces a bus fault. The worker handling the request crashes, dropping in-flight connections served by that process.

The network attack vector requires no authentication, no user interaction, and low complexity. The single-request nature of the trigger makes exploitation trivial to automate against exposed endpoints.

Root Cause

The root cause is unchecked pointer arithmetic on an unsigned 32-bit length variable in http_mime_parser.h. The parser subtracts field delimiters without validating that the resulting size is non-negative or non-zero. An empty name field between quotation marks satisfies the syntactic requirements of the header while producing a zero-byte token that triggers the underflow.

Attack Vector

Exploitation requires only network reachability to the vulnerable HTTP service. The attacker sends a POST request with a Content-Type: multipart/form-data header and a body containing a boundary section with a Content-Disposition: form-data; name="" header. The empty name value drives the length calculation into underflow during parsing.

The attacker does not need credentials, session state, or knowledge of application-level routes. Repeating the request against multiple worker processes can crash all workers and cause complete service outage. Refer to the VulnCheck Security Advisory and the GitHub PoC Repository for technical details.

Detection Methods for CVE-2026-66729

Indicators of Compromise

HTTP POST requests with Content-Type: multipart/form-data containing Content-Disposition headers where name="" is present
Unexpected SIGBUS or segmentation fault entries in worker process logs for facil.io-based services
Repeated worker process restarts or supervisor respawn events correlated with inbound multipart requests
Client connections dropped mid-request from a single source address

Detection Strategies

Inspect web server and application logs for multipart request bodies containing empty name attributes in Content-Disposition headers
Deploy web application firewall rules that reject multipart/form-data bodies with zero-length name field values
Monitor process supervisors such as systemd or container orchestrators for elevated facil.io worker crash and restart rates

Monitoring Recommendations

Enable core dump collection on facil.io workers to confirm bus-fault signatures during parsing
Alert on HTTP 5xx spikes or abrupt connection resets on endpoints that accept file uploads or form submissions
Correlate crash telemetry with source IP addresses to identify probing or automated exploitation attempts

How to Mitigate CVE-2026-66729

Immediate Actions Required

Inventory all services linking against facil.io versions 0.6.0 through 0.7.6 and prioritize internet-facing endpoints
Restrict or disable HTTP endpoints that accept multipart/form-data bodies until a fix is deployed
Deploy WAF or reverse-proxy rules that reject multipart bodies containing name="" in Content-Disposition headers
Enable automatic worker restart in the process supervisor to reduce outage duration during exploitation attempts

Patch Information

At the time of publication, no fixed release identifier is listed in the NVD entry for CVE-2026-66729. Consult the VulnCheck Security Advisory and the upstream facil.io repository for the latest remediation guidance. If a patched build is unavailable, apply the source-level workaround of validating the parsed name length before pointer arithmetic in http_mime_parser.h.

Workarounds

Terminate TLS and HTTP parsing at an upstream reverse proxy (for example nginx or HAProxy) that validates multipart headers before forwarding to the facil.io backend
Add an input filter that drops requests where Content-Disposition contains an empty name attribute
Lower per-worker request limits and enable rapid supervisor respawn to minimize disruption during exploitation attempts
Remove or rate-limit multipart upload endpoints that are not required for production functionality

bash

# Example nginx rule to block empty multipart name attributes
http {
    map $request_body $bad_multipart {
        default 0;
        "~*Content-Disposition:\s*form-data;\s*name=\"\"" 1;
    }

    server {
        location / {
            if ($bad_multipart) {
                return 400;
            }
            proxy_pass http://facilio_backend;
        }
    }
}