Loading story…
A high-severity denial-of-service flaw tracked as CVE-2026-66731 affects facil.io versions 0.7.5 through 0.7.6, with reporting also indicating exposure in master. The bug is in the HTTP/1.1 chunked transfer encoding parser, where a negative hexadecimal chunk size can be accepted and converted into a large positive integer, corrupting parser state and moving a read pointer into unmapped memory. An unauthenticated attacker can trigger the crash remotely with a single crafted POST request using Transfer-Encoding: chunked, making the issue low-complexity and network exploitable.
Advisories say the flaw was introduced when the 0.8.x HTTP/1.1 parser was backported into 0.7.5, specifically through http1_atol16 accepting a leading minus sign. A proof of concept has been noted, and CISA SSVC metadata marks exploitation as automatable with partial technical impact. Researchers also warned that the special case -0 may not crash the server but could create a request-smuggling primitive in proxy deployments that interpret chunked encoding differently; recommended fixes include rejecting signed chunk sizes in http1_atol16 or validating that chunk_len is non-negative before use.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
A denial-of-service vulnerability affecting facil.io 0.7.5 through 0.7.6 was publicly disclosed. The flaw allows an unauthenticated remote attacker to crash the server with a single crafted HTTP/1.1 chunked POST request using a negative chunk size value.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourcevulncheck.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity denial-of-service vulnerability, tracked as **CVE-2026-66730**, affects **facil.io** versions `0.6.0` through `0.7.6`, including impacted `0.6.x`, `0.7.x`, and `master` code lines. The flaw is in the framework's multipart MIME body parser, where a malformed `multipart/form-data` request containing a partial closing boundary can cause `http_mime_parse` to consume `0` bytes without setting completion or error flags. Because the caller continues parsing the same buffer, an unauthenticated remote attacker can force a worker process into a permanent `100%` CPU loop. The bug is classified as **CWE-835** and **CWE-400** and carries a **CVSS v3.1 score of 7.5** with high availability impact. Exploitation does not crash the server, which means affected workers may remain stuck rather than being automatically respawned; by sending enough crafted requests to match the worker count, an attacker can exhaust all workers and make the service unavailable until it is manually restarted. Public reporting says the issue stems from a missing progress guard in body parsing, and a proposed fix is to add a check in `http_parse_body()` to abort when parsing makes no forward progress.
Jul 28, 2026
New research and vendor advisories have highlighted a broader class of **HTTP desynchronization and request smuggling** risks driven by parser inconsistencies in headers and chunked encoding. A PortSwigger paper on **CRLF-powered desync attacks** warned that header injection can do far more than trigger open redirects or XSS, enabling attackers to "behead" HTTP streams and create severe front-end/back-end parsing mismatches. Related research on ambiguous chunk line terminators and chunk-extension parsing has shown how subtle differences in HTTP/1.1 handling can be turned into cache poisoning, security-control bypass, unauthorized access, and denial-of-service conditions. Red Hat documented multiple affected implementations under **CWE-444**. **`CVE-2026-33870`** in Netty was rated Important and stems from incorrect parsing of quoted strings in HTTP/1.1 chunked transfer-encoding extension values, with no acceptable mitigation listed beyond product fixes. **`CVE-2024-52304`** in aiohttp affects deployments using the pure Python parser, where newline handling in chunk extensions can let attackers bypass proxies or firewalls. **`CVE-2026-1525`** in Undici allows duplicate `Content-Length` headers through case-variant names, creating malformed requests that can trigger request smuggling or DoS. Supporting tooling such as **smugchunks** has emerged to detect chunk-parsing discrepancies in black-box testing, underscoring that these desync issues are practical and span multiple widely used HTTP stacks.
Aug 20, 2026
Apache disclosed **CVE-2026-71558**, a heap type confusion flaw in Apache Fory's C++ deserialization logic that affects versions `0.14.0` through versions before `1.5.0`. The vulnerability is triggered by a crafted input payload during polymorphic smart-pointer deserialization, allowing type compatibility checks to be bypassed so an incompatible object can be treated as the declared base type. Apache and downstream advisories warn that successful exploitation can cause undefined behavior and may lead to denial of service or **arbitrary code execution**. The issue is tracked as **CWE-502** and carries a **CVSS v3.1** vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, indicating a network-exploitable flaw with high impact across confidentiality, integrity, and availability. Apache said applications that do not use Fory C++ polymorphic smart-pointer deserialization are not affected, and recommended upgrading to **Apache Fory `1.5.0`**, which fixes the bug. The vulnerability was reported by independent security researcher **Zhixi "Jace" Sun**, while CISA SSVC metadata listed exploitation as none observed, automatable as yes, and technical impact as total.
Aug 7, 2026