CVE-2026-66731: facil.io HTTP Parser DoS Vulnerability

CVE-2026-66731 Overview

CVE-2026-66731 is a denial-of-service vulnerability in facil.io versions 0.7.5 through 0.7.6. The flaw resides in the HTTP/1.1 chunked transfer encoding parser implemented in http1_parser.h. Unauthenticated remote attackers can crash any server built on affected facil.io versions by sending a single POST request containing a Transfer-Encoding: chunked header with a negative chunk size value. The parser negates the signed value and produces a large positive integer, corrupting internal state and advancing the read pointer into unmapped memory. The result is a segmentation fault that terminates the server process. The vulnerability is classified under [CWE-125: Out-of-Bounds Read].

Critical Impact
A single unauthenticated HTTP request crashes any server running facil.io 0.7.5–0.7.6, producing full service outage without prior access or user interaction.

Affected Products

facil.io 0.7.5
facil.io 0.7.6
Any application or service embedding the affected facil.io HTTP/1.1 parser

Discovery Timeline

2026-07-27 - CVE-2026-66731 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-66731

Vulnerability Analysis

The facil.io HTTP/1.1 parser reads chunk sizes from the wire as hexadecimal ASCII values preceding each chunk body. The parser accepts a leading minus sign, converting it into a signed integer and then negating it. When the negated value is stored in an unsigned length field, it becomes a large positive integer approaching the maximum of the width. The parser subsequently uses this length to advance the buffer read pointer, jumping far beyond the allocated request buffer into unmapped virtual memory. The invalid dereference triggers a fault that terminates the process. Because the server accepts the malformed request before any authentication check, exploitation requires only network reachability to the listening port.

Root Cause

The root cause is missing input validation in the chunk size parsing routine within http1_parser.h. The code path treats a signed intermediate value as if it were bounded and does not reject negative results before assigning them to an unsigned length variable. This sign-conversion error violates the invariant that HTTP chunk sizes must be non-negative hexadecimal integers as defined by RFC 7230.

Attack Vector

An attacker connects to the target service and issues a single HTTP/1.1 POST request. The request includes the header Transfer-Encoding: chunked and a body whose first chunk size field begins with a minus sign, for example -1\r\n. On receipt, the parser computes the negated width, advances the read pointer past the allocated buffer, and the worker process crashes. Repeating the request keeps the service unavailable. No authentication, session, or prior user interaction is required. Public proof-of-concept material describing the request layout is available at the GitHub PoC Repository and in the VulnCheck Security Advisory.

Detection Methods for CVE-2026-66731

Indicators of Compromise

HTTP request logs containing a Transfer-Encoding: chunked header followed by a chunk size field beginning with - (minus sign).
Unexpected worker process termination with SIGSEGV on hosts running facil.io 0.7.5 or 0.7.6.
Repeated short-lived POST requests from a single source immediately preceding service outages.

Detection Strategies

Inspect HTTP request bodies at the reverse proxy or WAF for chunk size lines that do not match the pattern ^[0-9A-Fa-f]+(;.*)?$.
Correlate crash-loop events (systemd restarts, container exit code 139) with inbound HTTP traffic to identify triggering sources.
Enable core dump collection on affected services and verify faulting instruction addresses against http1_parser.h symbols.

Monitoring Recommendations

Alert on abnormally high rates of TCP reconnects and short HTTP sessions terminated before response.
Track service uptime and restart counts for any process embedding facil.io.
Forward web server and reverse proxy logs to a centralized SIEM and hunt for the negative chunk size pattern.

How to Mitigate CVE-2026-66731

Immediate Actions Required

Inventory all services and applications that link against facil.io 0.7.5 or 0.7.6.
Place a validating reverse proxy or WAF in front of exposed facil.io endpoints to filter malformed chunked requests.
Restrict network exposure of affected services to trusted sources until a fixed build is deployed.

Patch Information

No vendor patch reference is available in the enriched CVE data. Consult the upstream facil.io repository and the VulnCheck Security Advisory for the current remediation status. Rebuild and redeploy any embedded applications once a corrected release is published.

Workarounds

Terminate HTTP/1.1 at a hardened proxy such as nginx or HAProxy that rejects non-hexadecimal chunk sizes before forwarding traffic.
Disable acceptance of Transfer-Encoding: chunked requests at the proxy where the application does not require streaming uploads.
Deploy rate limiting and connection-drop rules for source IPs that trigger repeated worker crashes.

bash

# Example nginx snippet: reject requests with Transfer-Encoding: chunked
# for services that do not require chunked uploads
location / {
    if ($http_transfer_encoding ~* chunked) {
        return 400;
    }
    proxy_pass http://facilio_backend;
}