CVE-2026-16632

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-16632", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-07-22T16:13:01.618Z", "datePublished": "2026-07-22T23:45:10.246Z", "dateUpdated": "2026-07-23T15:36:53.311Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-07-22T23:45:10.246Z"}, "title": "boazsegev facil.io WebSocket Frame websocket_parser.h websocket_on_protocol_error input validation", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-20", "lang": "en", "description": "Improper Input Validation"}]}], "affected": [{"vendor": "boazsegev", "product": "facil.io", "versions": [{"version": "0.7.0", "status": "affected"}, {"version": "0.7.1", "status": "affected"}, {"version": "0.7.2", "status": "affected"}, {"version": "0.7.3", "status": "affected"}, {"version": "0.7.4", "status": "affected"}], "cpes": ["cpe:2.3:a:boazsegev:facil.io:*:*:*:*:*:*:*:*"], "modules": ["WebSocket Frame Parser"]}], "descriptions": [{"lang": "en", "value": "A flaw has been found in boazsegev facil.io up to 0.7.4. Affected is the function websocket_on_protocol_error in the library lib/facil/http/parsers/websocket_parser.h of the component WebSocket Frame Parser. This manipulation of the argument on_message causes improper input validation. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "HIGH"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "HIGH"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-07-22T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-07-22T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-07-22T18:18:08.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Fantasy_2026 (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/382382", "name": "VDB-382382 | boazsegev facil.io WebSocket Frame websocket_parser.h websocket_on_protocol_error input validation", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/382382/cti", "name": "VDB-382382 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-16632", "name": "CVE-2026-16632 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/860585", "name": "Submit #860585 | facil.io <= 0.7.4 Improper Input Validation", "tags": ["third-party-advisory"]}, {"url": "https://github.com/boazsegev/facil.io/issues/169", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/boazsegev/facil.io/", "tags": ["product"]}]}, "adp": [{"references": [{"url": "https://vuldb.com/submit/860585", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-23T15:34:33.430401Z", "id": "CVE-2026-16632", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-23T15:36:53.311Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "boazsegev facil.io WebSocket Frame websocket_parser.h websocket_on_protocol_error input validation", "credits": [{"lang": "en", "type": "reporter", "value": "Fantasy_2026 (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:boazsegev:facil.io:*:*:*:*:*:*:*:*"], "vendor": "boazsegev", "modules": ["WebSocket Frame Parser"], "product": "facil.io", "versions": [{"status": "affected", "version": "0.7.0"}, {"status": "affected", "version": "0.7.1"}, {"status": "affected", "version": "0.7.2"}, {"status": "affected", "version": "0.7.3"}, {"status": "affected", "version": "0.7.4"}]}], "timeline": [{"lang": "en", "time": "2026-07-22T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-07-22T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-07-22T18:18:08.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/382382", "name": "VDB-382382 | boazsegev facil.io WebSocket Frame websocket_parser.h websocket_on_protocol_error input validation", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/382382/cti", "name": "VDB-382382 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-16632", "name": "CVE-2026-16632 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/860585", "name": "Submit #860585 | facil.io <= 0.7.4 Improper Input Validation", "tags": ["third-party-advisory"]}, {"url": "https://github.com/boazsegev/facil.io/issues/169", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/boazsegev/facil.io/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A flaw has been found in boazsegev facil.io up to 0.7.4. Affected is the function websocket_on_protocol_error in the library lib/facil/http/parsers/websocket_parser.h of the component WebSocket Frame Parser. This manipulation of the argument on_message causes improper input validation. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "Improper Input Validation"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-07-22T23:45:10.246Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-16632", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-23T15:34:33.430401Z"}}}], "references": [{"url": "https://vuldb.com/submit/860585", "tags": ["exploit"]}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-07-23T15:34:38.889Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-16632", "state": "PUBLISHED", "dateUpdated": "2026-07-22T23:45:10.246Z", "dateReserved": "2026-07-22T16:13:01.618Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-07-22T23:45:10.246Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:boazsegev:facil.io:*:*:*:*:*:*:*:*"], "modules": ["WebSocket Frame Parser"], "product": "facil.io", "vendor": "boazsegev", "versions": [{"status": "affected", "version": "0.7.0"}, {"status": "affected", "version": "0.7.1"}, {"status": "affected", "version": "0.7.2"}, {"status": "affected", "version": "0.7.3"}, {"status": "affected", "version": "0.7.4"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw has been found in boazsegev facil.io up to 0.7.4. Affected is the function websocket_on_protocol_error in the library lib/facil/http/parsers/websocket_parser.h of the component WebSocket Frame Parser. This manipulation of the argument on_message causes improper input validation. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet."}, {"lang": "es", "value": "Se ha encontrado una falla en boazsegev facil.io hasta 0.7.4. La funci\u00f3n afectada es websocket_on_protocol_error en la biblioteca lib/facil/http/parsers/websocket_parser.h del componente WebSocket Frame Parser. Esta manipulaci\u00f3n del argumento on_message causa una validaci\u00f3n de entrada incorrecta. El ataque puede iniciarse de forma remota. El exploit ha sido publicado y puede ser utilizado. Se inform\u00f3 al proyecto del problema con antelaci\u00f3n a trav\u00e9s de un informe de incidencias, pero a\u00fan no ha respondido."}], "id": "CVE-2026-16632", "lastModified": "2026-10-24T13:10:00.147", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-16632", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-23T15:34:33.430401Z", "version": "2.0.3"}}]}, "published": "2026-07-23T00:16:28.020", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/boazsegev/facil.io/"}, {"source": "cna@vuldb.com", "url": "https://github.com/boazsegev/facil.io/issues/169"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-16632"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/860585"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/382382"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/382382/cti"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://vuldb.com/submit/860585"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.7.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.7.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.7.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.7.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.7.4"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "facil.io", "source": "cna", "vendor": "boazsegev"}, "product": "facil.io", "vendor": "boazsegev"}], "created": "2026-07-23T10:30:06.801722+00:00", "updated": "2026-08-03T23:15:04.018155+00:00", "vendors": ["boazsegev", "boazsegev$PRODUCT$facil.io"]}