HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-66731 — facil.io 0.7.5 through 0.7.6 contains a denial-of-service vulnerability in the H...

·Source: NIST NVD

Updated:

Executive Summary

facil.io 0.7.5 through 0.7.6 contains a denial-of-service vulnerability in the HTTP/1.1 chunked transfer encoding parser that allows unauthenticated remote attackers to crash the server by sending a negative chunk size value. Attackers can send a single POST request with a Transfer-Encoding: chunked header containing a leading minus sign in the chunk size field, causing the parser in http1_parser.

Analysis

facil.io 0.7.5 through 0.7.6 contains a denial-of-service vulnerability in the HTTP/1.1 chunked transfer encoding parser that allows unauthenticated remote attackers to crash the server by sending a negative chunk size value. Attackers can send a single POST request with a Transfer-Encoding: chunked header containing a leading minus sign in the chunk size field, causing the parser in http1_parser.h to compute a large positive integer from the negated value, corrupting internal state and moving the read pointer into unmapped memory resulting in a fault. CVSS Score: 7.5. Published: 2026-07-27T17:16:42.793.

Indicators of Compromise (2)

CVE (1)
CVE-2026-66731
NVDMITRE CVE
Domain (1)
facil.io
VirusTotalURLhaus
Source Attribution

Originally published by NIST NVD on Jul 27, 2026. Verified by: NIST.

Related Threats

HIGHVulnerability

NVD HIGH: CVE-2026-67343 — ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the...

ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the GET /api/v1/server endpoint, allowing authenticated users to retrieve the arcadedb.ha.clusterToken value in cleartext. Attackers can use the leaked token with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User headers to impersonate root and execute administrative actions including user creation, database operatio

CVE-2026-67343
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-67342 — ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in...

ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not authorized to use by directly calling affected endpoints with arbitrary database parameters.

CVE-2026-67342
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-67341 — ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks o...

ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with LANGUAGE js. Attackers with database access can execute arbitrary JavaScript code by submitting DEFINE FUNCTION statements, bypassing security controls intended to restrict scripting to administrators.

CVE-2026-67341
NIST NVD