CVE-2026-66731

Name of the Vulnerable Software and Affected Versions facil.io versions 0.7.5 through 0.7.6

Description A denial-of-service issue exists in the HTTP/1.1 chunked transfer encoding parser. An unauthenticated remote attacker can crash the server by sending a single POST request with a Transfer-Encoding: chunked header that includes a negative value in the chunk size field. This causes the parser in http1 parser.h to calculate a large positive integer from the negated value, which corrupts the internal state and moves the read pointer into unmapped memory, leading to a system fault.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.