CVE-2026-41146

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41146", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-17T12:59:15.739Z", "datePublished": "2026-04-22T01:07:28.660Z", "dateUpdated": "2026-04-22T13:09:38.075Z"}, "containers": {"cna": {"title": "facil.io and downstream iodine ruby gem vulnerable to uncontrolled resource consumption and loop with unreachable exit condition", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-835", "lang": "en", "description": "CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/boazsegev/facil.io/security/advisories/GHSA-2x79-gwq3-vxxm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/boazsegev/facil.io/security/advisories/GHSA-2x79-gwq3-vxxm"}, {"name": "https://github.com/boazsegev/facil.io/commit/5128747363055201d3ecf0e29bf0a961703c9fa0", "tags": ["x_refsource_MISC"], "url": "https://github.com/boazsegev/facil.io/commit/5128747363055201d3ecf0e29bf0a961703c9fa0"}], "affected": [{"vendor": "boazsegev", "product": "facil.io", "versions": [{"version": "< 5128747363055201d3ecf0e29bf0a961703c9fa0", "status": "affected"}]}, {"vendor": "boazsegev", "product": "iodine", "versions": [{"version": "< 0.7.59", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-22T01:07:28.660Z"}, "descriptions": [{"lang": "en", "value": "facil.io is a C micro-framework for web applications. Prior to commit 5128747363055201d3ecf0e29bf0a961703c9fa0, `fio_json_parse` can enter an infinite loop when it encounters a nested JSON value starting with `i` or `I`. The process spins in user space and pegs one CPU core at ~100% instead of returning a parse error. Because `iodine` vendors the same parser code, the issue also affects `iodine` when it parses attacker-controlled JSON. The smallest reproducer I found is `[i`. The quoted-value form that originally exposed the issue, `[\"\"i`, reaches the same bug because the parser tolerates missing commas and then treats the trailing `i` as the start of another value. Commit 5128747363055201d3ecf0e29bf0a961703c9fa0 fixes the issue."}], "source": {"advisory": "GHSA-2x79-gwq3-vxxm", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/boazsegev/facil.io/security/advisories/GHSA-2x79-gwq3-vxxm", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-22T13:09:34.301684Z", "id": "CVE-2026-41146", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T13:09:38.075Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41146", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-22T13:09:34.301684Z"}}}], "references": [{"url": "https://github.com/boazsegev/facil.io/security/advisories/GHSA-2x79-gwq3-vxxm", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T13:09:26.346Z"}}], "cna": {"title": "facil.io and downstream iodine ruby gem vulnerable to uncontrolled resource consumption and loop with unreachable exit condition", "source": {"advisory": "GHSA-2x79-gwq3-vxxm", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "boazsegev", "product": "facil.io", "versions": [{"status": "affected", "version": "< 5128747363055201d3ecf0e29bf0a961703c9fa0"}]}, {"vendor": "boazsegev", "product": "iodine", "versions": [{"status": "affected", "version": "< 0.7.59"}]}], "references": [{"url": "https://github.com/boazsegev/facil.io/security/advisories/GHSA-2x79-gwq3-vxxm", "name": "https://github.com/boazsegev/facil.io/security/advisories/GHSA-2x79-gwq3-vxxm", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/boazsegev/facil.io/commit/5128747363055201d3ecf0e29bf0a961703c9fa0", "name": "https://github.com/boazsegev/facil.io/commit/5128747363055201d3ecf0e29bf0a961703c9fa0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "facil.io is a C micro-framework for web applications. Prior to commit 5128747363055201d3ecf0e29bf0a961703c9fa0, `fio_json_parse` can enter an infinite loop when it encounters a nested JSON value starting with `i` or `I`. The process spins in user space and pegs one CPU core at ~100% instead of returning a parse error. Because `iodine` vendors the same parser code, the issue also affects `iodine` when it parses attacker-controlled JSON. The smallest reproducer I found is `[i`. The quoted-value form that originally exposed the issue, `[\"\"i`, reaches the same bug because the parser tolerates missing commas and then treats the trailing `i` as the start of another value. Commit 5128747363055201d3ecf0e29bf0a961703c9fa0 fixes the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-835", "description": "CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-22T01:07:28.660Z"}}}, "cveMetadata": {"cveId": "CVE-2026-41146", "state": "PUBLISHED", "dateUpdated": "2026-04-22T13:09:38.075Z", "dateReserved": "2026-04-17T12:59:15.739Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-22T01:07:28.660Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "facil.io", "vendor": "boazsegev", "versions": [{"status": "affected", "version": "< 5128747363055201d3ecf0e29bf0a961703c9fa0"}]}, {"product": "iodine", "vendor": "boazsegev", "versions": [{"status": "affected", "version": "< 0.7.59"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "facil.io is a C micro-framework for web applications. Prior to commit 5128747363055201d3ecf0e29bf0a961703c9fa0, `fio_json_parse` can enter an infinite loop when it encounters a nested JSON value starting with `i` or `I`. The process spins in user space and pegs one CPU core at ~100% instead of returning a parse error. Because `iodine` vendors the same parser code, the issue also affects `iodine` when it parses attacker-controlled JSON. The smallest reproducer I found is `[i`. The quoted-value form that originally exposed the issue, `[\"\"i`, reaches the same bug because the parser tolerates missing commas and then treats the trailing `i` as the start of another value. Commit 5128747363055201d3ecf0e29bf0a961703c9fa0 fixes the issue."}, {"lang": "es", "value": "facil.io es un micro-framework C para aplicaciones web. Antes del commit 5128747363055201d3ecf0e29bf0a961703c9fa0, \u2019fio_json_parse\u2019 puede entrar en un bucle infinito cuando encuentra un valor JSON anidado que comienza con \u2019i\u2019 o \u2019I\u2019. El proceso se ejecuta en un bucle en el espacio de usuario y fija un n\u00facleo de CPU al ~100% en lugar de devolver un error de an\u00e1lisis. Debido a que \u2019iodine\u2019 distribuye el mismo c\u00f3digo de analizador, el problema tambi\u00e9n afecta a \u2019iodine\u2019 cuando analiza JSON controlado por el atacante. El reproductor m\u00e1s peque\u00f1o que encontr\u00e9 es \u2019[i\u2019. La forma de valor entre comillas que originalmente expuso el problema, \u2019[\u201c\u201di\u2019, alcanza el mismo error porque el analizador tolera comas faltantes y luego trata la \u2019i\u2019 final como el inicio de otro valor. El commit 5128747363055201d3ecf0e29bf0a961703c9fa0 soluciona el problema."}], "id": "CVE-2026-41146", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41146", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-22T13:09:34.301684Z", "version": "2.0.3"}}]}, "published": "2026-04-22T02:16:02.237", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/boazsegev/facil.io/commit/5128747363055201d3ecf0e29bf0a961703c9fa0"}, {"source": "security-advisories@github.com", "url": "https://github.com/boazsegev/facil.io/security/advisories/GHSA-2x79-gwq3-vxxm"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/boazsegev/facil.io/security/advisories/GHSA-2x79-gwq3-vxxm"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-835"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0,5128747363055201d3ecf0e29bf0a961703c9fa0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "facil.io", "source": "cna", "vendor": "boazsegev"}, "product": "facil.io", "vendor": "boazsegev"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.7.59)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "iodine", "source": "cna", "vendor": "boazsegev"}, "product": "iodine", "vendor": "boazsegev"}], "analysis": {"en": {"generated_at": "2026-04-22T04:23:13.702087+00:00", "value": {"mitigation_remediation": ["Upgrade facil.io to a version containing commit\u202f5128747363055201d3ecf0e29bf0a961703c9fa0 or later.", "Upgrade the iodine gem to a patched release that incorporates the same fix.", "If an upgrade cannot be performed immediately, isolate or disable the JSON parsing functionality for untrusted input, or replace it with a safer parser that validates the structure before consuming resources."], "summary": {"action": "Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "Both the facil.io C micro\u2011framework and the iodine Ruby gem share the same parsing logic. Any installation of facil.io or iodine that predates commit\u202f5128747363055201d3ecf0e29bf0a961703c9fa0 is vulnerable. The issue manifests for any JSON payload that includes a nested value starting with 'i' or 'I', the smallest reproducer being `[i`. This affects all deployments that accept attacker\u2011controlled JSON input through facil.io or iodine.", "description_and_impact": "The vulnerability resides in facil.io\u2019s `fio_json_parse` function. When it encounters a nested JSON value that begins with the letter 'i' or 'I', the parser falls into an infinite loop. This unbounded loop consumes CPU resources, pegging a core at 100\u202f% and preventing the process from returning a parse error. The effect is an uncontrolled resource consumption that results in denial of service. The flaw maps to CWE\u2011400 and CWE\u2011835.", "risk_and_exploitability": "The CVSS score of 8.7 indicates a high severity vulnerability. Exploitation requires the attacker to send a crafted JSON request to an application that uses the vulnerable parser, a condition that is likely met in publicly accessible services. The lack of an EPSS score and absence from the KEV catalog do not diminish the risk; the bug is reproducible and surfaces as an immediate denial of service once the payload reaches the parser. Attackers could cause CPU exhaustion with zero privileged access, making the vulnerability highly actionable."}}}}, "created": "2026-04-22T04:30:05.301303+00:00", "updated": "2026-04-22T11:44:52.802242+00:00", "vendors": ["boazsegev", "boazsegev$PRODUCT$facil.io", "boazsegev$PRODUCT$iodine"]}