CyberRota Analysis
AI-GeneratedThe multipart body parser in facil.io versions 0.6.0 to 0.7.6 is vulnerable to a denial-of-service attack, allowing unauthenticated remote attackers to indefinitely freeze worker processes by sending specially crafted multipart/form-data requests. This results in 100% CPU utilization, effectively disabling the server until it is manually restarted. Organizations using these versions of facil.io should prioritize patching to mitigate the risk of service disruption.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart body parser that allows an unauthenticated remote attacker to permanently freeze worker processes at 100% CPU by sending a multipart/form-data request with a partial closing boundary. The missing progress guard in the parser loop causes http_mime_parse to return 0 bytes consumed without setting done or error flags, causing the calling loop to re-invoke the parser on the same buffer indefinitely, exhausting all workers and permanently disabling the server until manually restarted.