CVE-2026-66730-Infinite-Loop-DoS-in-facil.io-MIME-Parser

セキュリティアドバイザリ: facil.io MIMEパーサーにおける無限ループDoS不完全なバウンダリ 割り当てられたCVE ID : CVE-2026-66730 製品: facil.io 影響を受けるバージョン: facil.io = 0.6.0 すべての0.6.x、すべての0.7.x、master; MIMEパーサーとともに0.6.0で導入 コンポーネント: lib/facil/http/http.c, lib/facil/http/parsers/httpmimeparser.h CWE: CWE-835 到達不能な終了条件を持つループ, CWE-400 制御されないリソース消...

CVE-2026-66730

CVE-2026-66730 concerns facil.io versions 0.6.0–0.7.6, where the multipart body parser is vulnerable to a denial-of-service. The root cause is a missing progress guard in the parser loop: http_mime_parse can return 0 bytes consumed without setting done or error flags, causing the caller to repeat...

CVE-2026-66730 facil.io 0.6.0 - 0.7.6 Infinite Loop DoS via Multipart MIME Body Parser

facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart body parser that allows an unauthenticated remote attacker to permanently freeze worker processes at 100% CPU by sending a multipart/form-data request with a partial closing boundary. The missing progress gua...

CVE-2026-66730 facil.io 0.6.0 - 0.7.6 Infinite Loop DoS via Multipart MIME Body Parser

facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart body parser that allows an unauthenticated remote attacker to permanently freeze worker processes at 100% CPU by sending a multipart/form-data request with a partial closing boundary. The missing progress gua...

PT-2026-65066

Name of the Vulnerable Software and Affected Versions facil.io versions 0.6.0 through 0.7.6 Description A denial-of-service issue exists in the multipart body parser. An unauthenticated remote attacker can freeze worker processes at 100% CPU by sending a multipart/form-data request containing a...