These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-66731 is a denial-of-service vulnerability in facil.io 0.7.5 through 0.7.6. The vulnerability is caused by a flaw in the HTTP/1.1 chunked transfer encoding parser that allows unauthenticated remote attackers to crash the server by sending a negative chunk size value. This vulnerability has a high CVSS score of 8.7 and is classified as HIGH severity. Users of facil.io 0.7.5 through 0.7.6 should be [truncated]
CVE-2026-66730 is a denial-of-service vulnerability in facil.io versions 0.6.0 through 0.7.6. The vulnerability is located in the multipart body parser and allows an unauthenticated remote attacker to permanently freeze worker processes at 100% CPU by sending a multipart/form-data request with a partial closing boundary. The missing progress guard in the parser loop causes http_mime_parse to return 0 byte [truncated]
CVE-2026-66729 is an integer underflow vulnerability in facil.io 0.6.0 through 0.7.6. The vulnerability allows unauthenticated remote attackers to crash the server process by sending a crafted Content-Disposition header with an empty field name. This issue can lead to a denial-of-service condition. Users of facil.io 0.6.0 through 0.7.6 should be aware of this vulnerability and take steps to mitigate it.
CVE-2026-16653 is a path traversal vulnerability in boazsegev facil.io up to 0.7.58, affecting the http_sendfile2 function in lib/facil/http/http.c. The vulnerability allows remote exploitation and has been publicly disclosed. However, details on affected versions, exploitation, and remediation are limited. Defenders should assess exposure, verify inventory, and monitor for exploitation attempts. The CVE [truncated]
CVE-2026-16632 is a MEDIUM-severity vulnerability in the boazsegev facil.io library, specifically in the WebSocket Frame Parser component. The vulnerability is caused by improper input validation in the websocket_on_protocol_error function. According to the CVE Program record and NVD vulnerability detail, the attack can be initiated remotely. The project was informed of the problem early through an issue [truncated]