These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-66731 is a denial-of-service vulnerability in facil.io 0.7.5 through 0.7.6. The vulnerability is caused by a flaw in the HTTP/1.1 chunked transfer encoding parser that allows unauthenticated remote attackers to crash the server by sending a negative chunk size value. This vulnerability has a high CVSS score of 8.7 and is classified as HIGH severity. Users of facil.io 0.7.5 through 0.7.6 should be [truncated]
CVE-2026-66730 is a denial-of-service vulnerability in facil.io versions 0.6.0 through 0.7.6. The vulnerability is located in the multipart body parser and allows an unauthenticated remote attacker to permanently freeze worker processes at 100% CPU by sending a multipart/form-data request with a partial closing boundary. The missing progress guard in the parser loop causes http_mime_parse to return 0 byte [truncated]
CVE-2026-66729 is an integer underflow vulnerability in facil.io 0.6.0 through 0.7.6. The vulnerability allows unauthenticated remote attackers to crash the server process by sending a crafted Content-Disposition header with an empty field name. This issue can lead to a denial-of-service condition. Users of facil.io 0.6.0 through 0.7.6 should be aware of this vulnerability and take steps to mitigate it.