HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-66729 — facil.io through 0.7.6 contains an integer underflow vulnerability in the multip...

·Source: NIST NVD

Updated:

Executive Summary

facil.io through 0.7.6 contains an integer underflow vulnerability in the multipart MIME body parser that allows unauthenticated remote attackers to crash the server process by sending a crafted Content-Disposition header with an empty field name. Attackers can trigger a uint32_t wraparound in http_mime_parser.h causing an out-of-bounds memory read past the name pointer, resulting in a bus fault t

Analysis

facil.io through 0.7.6 contains an integer underflow vulnerability in the multipart MIME body parser that allows unauthenticated remote attackers to crash the server process by sending a crafted Content-Disposition header with an empty field name. Attackers can trigger a uint32_t wraparound in http_mime_parser.h causing an out-of-bounds memory read past the name pointer, resulting in a bus fault that crashes the handling worker with a single POST request. CVSS Score: 7.5. Published: 2026-07-27T17:16:42.517.

Indicators of Compromise (2)

CVE (1)
CVE-2026-66729
NVDMITRE CVE
Domain (1)
facil.io
VirusTotalURLhaus
Source Attribution

Originally published by NIST NVD on Jul 27, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Lloyds Banking Group and Caixabank complete tokenised deposit transactions through Project Agorá

Lloyds Banking Group has completed three live tokenised deposit transactions through tokenisation initiative Project Agorá.

Finextra
MEDIUMVulnerabilityNEW

Google AI Uncovers 13-Year-Old Chrome Flaw Amid Record Patching Pace

The internet giant has built an agent harness to find vulnerabilities across Chrome’s codebase. The post Google AI Uncovers 13-Year-Old Chrome Flaw Amid Record Patching Pace appeared first on SecurityWeek .

SecurityWeek
MEDIUMVulnerabilityNEW

FinregE publishes framework in preparation for FCA's 2026 Cryptoasset Regime

FinregE, The End-to-End Regulatory Operating System (FinregE ROS), is urging digital asset firms to fundamentally change how they prepare for the UK's regulatory landscape. To achieve this, the company has introduced a strategic framework to bridge the widening “Execution Gap” ahead of the 2026 Financial Conduct Authority (FCA) Cryptoasset Regime.

Finextra