What’s Vulnerable › Vulnerabilities

CVE-2026-41146: facil.io and downstream iodine ruby gem vulnerable to uncontrolled resource consumption and loop with unreachable exit condition

• Severity: high (CVSS 8.7 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-22 · updated 2026-10-26
• Weakness: CWE-400

Description

facil.io is a C micro-framework for web applications. Prior to commit 5128747363055201d3ecf0e29bf0a961703c9fa0, `fio_json_parse` can enter an infinite loop when it encounters a nested JSON value starting with `i` or `I`. The process spins in user space and pegs one CPU core at ~100% instead of returning a parse error. Because `iodine` vendors the same parser code, the issue also affects `iodine` when it parses attacker-controlled JSON. The smallest reproducer I found is `[i`. The quoted-value form that originally exposed the issue, `[""i`, reaches the same bug because the parser tolerates missing commas and then treats the trailing `i` as the start of another value. Commit 5128747363055201d3ecf0e29bf0a961703c9fa0 fixes the issue.

Affected products

• boazsegev facil.io: before 5128747363055201d3ecf0e29bf0a961703c9fa0
• boazsegev iodine: before 0.7.59

References

• https://github.com/boazsegev/facil.io/commit/5128747363055201d3ecf0e29bf0a961703c9fa0
• https://github.com/boazsegev/facil.io/security/advisories/GHSA-2x79-gwq3-vxxm
• https://github.com/boazsegev/facil.io/security/advisories/GHSA-2x79-gwq3-vxxm

Get alerted when CVE-2026-41146 or the next vulnerability affects your stack