CVE-2026-41146 Details
Description
facil.io is a C micro-framework for web applications. Prior to commit 5128747363055201d3ecf0e29bf0a961703c9fa0, `fio_json_parse` can enter an infinite loop when it encounters a nested JSON value starting with `i` or `I`. The process spins in user space and pegs one CPU core at ~100% instead of returning a parse error. Because `iodine` vendors the same parser code, the issue also affects `iodine` when it parses attacker-controlled JSON. The smallest reproducer I found is `[i`. The quoted-value form that originally exposed the issue, `[""i`, reaches the same bug because the parser tolerates missing commas and then treats the trailing `i` as the start of another value. Commit 5128747363055201d3ecf0e29bf0a961703c9fa0 fixes the issue.
A denial-of-service vulnerability has been identified in facil.io, a C micro-framework for web applications, and in the Iodine Ruby gem, which vendors the same JSON parser code. The issue arises in the JSON parsing function 'fio_json_parse', which can enter an infinite loop when it encounters a nested JSON value starting with 'i' or 'I'. Instead of returning a parse error, the process consumes nearly 100% of one CPU core. This vulnerability is present in facil.io versions prior to the patch commit and in Iodine versions through 0.7.58.
Users of facil.io should update to the version that includes the patch for this vulnerability. Iodine users should update to version 0.7.59.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 22, 2026CISA-ADP
Assessed Apr 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/boazsegev/facil.io/security/advisories/GHSA-2x79-gwq3-vxxm | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/boazsegev/facil.io/commit/5128747363055201d3ecf0e29bf0a961703c9fa0 | [email protected] | Source CodeVendor |
| https://github.com/boazsegev/facil.io/security/advisories/GHSA-2x79-gwq3-vxxm | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-835 | Loop with Unreachable Exit Condition ('Infinite Loop') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| boazsegev facil.io | All versions |
CPE
Remediation
| |
| iodine | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 22, 2026 | CVE Modified | CISA-ADP |
| Apr 22, 2026 | New CVE Received | [email protected] |