Loading story…
A high-severity denial-of-service vulnerability, tracked as CVE-2026-66730, affects facil.io versions 0.6.0 through 0.7.6, including impacted 0.6.x, 0.7.x, and master code lines. The flaw is in the framework's multipart MIME body parser, where a malformed multipart/form-data request containing a partial closing boundary can cause http_mime_parse to consume 0 bytes without setting completion or error flags. Because the caller continues parsing the same buffer, an unauthenticated remote attacker can force a worker process into a permanent 100% CPU loop.
The bug is classified as CWE-835 and CWE-400 and carries a CVSS v3.1 score of 7.5 with high availability impact. Exploitation does not crash the server, which means affected workers may remain stuck rather than being automatically respawned; by sending enough crafted requests to match the worker count, an attacker can exhaust all workers and make the service unavailable until it is manually restarted. Public reporting says the issue stems from a missing progress guard in body parsing, and a proposed fix is to add a check in http_parse_body() to abort when parsing makes no forward progress.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
A denial-of-service vulnerability affecting facil.io 0.6.0 through 0.7.6 was publicly disclosed as CVE-2026-66730. The flaw allows an unauthenticated attacker to send a malformed multipart/form-data request with a partial closing boundary and trap worker processes in an infinite 100% CPU loop, potentially exhausting all workers until manual restart.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity denial-of-service flaw tracked as **CVE-2026-66731** affects **facil.io** versions `0.7.5` through `0.7.6`, with reporting also indicating exposure in `master`. The bug is in the HTTP/1.1 chunked transfer encoding parser, where a negative hexadecimal chunk size can be accepted and converted into a large positive integer, corrupting parser state and moving a read pointer into unmapped memory. An unauthenticated attacker can trigger the crash remotely with a single crafted `POST` request using `Transfer-Encoding: chunked`, making the issue low-complexity and network exploitable. Advisories say the flaw was introduced when the `0.8.x` HTTP/1.1 parser was backported into `0.7.5`, specifically through `http1_atol16` accepting a leading minus sign. A proof of concept has been noted, and CISA SSVC metadata marks exploitation as automatable with partial technical impact. Researchers also warned that the special case `-0` may not crash the server but could create a request-smuggling primitive in proxy deployments that interpret chunked encoding differently; recommended fixes include rejecting signed chunk sizes in `http1_atol16` or validating that `chunk_len` is non-negative before use.
Jul 28, 2026
Several high-severity vulnerabilities have been disclosed in the **Tenda F456** router running firmware `1.0.0.5`, affecting the device’s `httpd` component across multiple `/goform/` endpoints. The flaws include `CVE-2026-7053` in `frmL7ProtForm` via `/goform/L7Prot`, `CVE-2026-7055` in `fromVirtualSer` via `/goform/VirtualSer`, `CVE-2026-7056` in `fromSafeUrlFilter` via `/goform/SafeUrlFilter`, and `CVE-2026-7057` in `/goform/setcfm`. In each case, crafted input to parameters such as `page`, `menufacturer`, `Go`, `funcname`, or `funcpara1` can trigger a buffer overflow. The vulnerabilities are described as **remotely exploitable** and have been mapped to `CWE-119` and `CWE-120`, with CVSS scoring indicating high impact to confidentiality, integrity, and availability. Public exploit code has also been reported for all four issues, including references to VulDB and GitHub proof-of-concept material, raising the risk of active attacks against exposed devices. Organizations using affected Tenda F456 routers should treat the flaws as urgent exposure in internet-facing network infrastructure.
Jun 29, 2026
A high-severity denial-of-service vulnerability, tracked as **`CVE-2026-16756`**, was disclosed in Amazon's Rust-based **`aws-smithy-http-server`** library. The flaw affects versions up to and including **`0.66.4`** and stems from the default **`serve()`** path accepting connections without effective limits, including missing connection and header-read timeouts and no cap on concurrent connections. An unauthenticated remote attacker can exploit the weakness with a **Slowloris-style** attack by holding many incomplete connections open until server sockets and async tasks are exhausted, causing service unavailability. The issue is classified as **`CWE-770`** and carries a **high availability impact** under **CVSS v3.1 `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`**. Reports say the vulnerable runtime used by generated servers can spawn unbounded work for incoming connections, enabling resource exhaustion and service immobilization. The recommended remediation is to upgrade to **`aws-smithy-http-server 0.66.5`** or later, where bounded connection handling and explicit timeout controls, including header-read timeouts and semaphore-based concurrency limits, were introduced.
Jul 25, 2026