Boazsegev vulnerabilities
We track 6 vulnerabilities in Boazsegev products across 2 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on July 27, 2026.
Latest Boazsegev vulnerabilities
- 7.5 High severity
facil.io: Out-of-bounds Read
facil.io 0.7.5 through 0.7.6 contains a denial-of-service vulnerability in the HTTP/1.1 chunked transfer encoding parser that allows unauthenticated remote attackers to crash the server by sending a negative chunk size value. Attackers can send a single POST r
- 7.5 High severity
facil.io: Loop with Unreachable Exit Condition
facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart body parser that allows an unauthenticated remote attacker to permanently freeze worker processes at 100% CPU by sending a multipart/form-data request with a partial closi
- 7.5 High severity
facil.io: Out-of-bounds Read
facil.io 0.6.0 through 0.7.6 contains an integer underflow vulnerability in the multipart MIME body parser that allows unauthenticated remote attackers to crash the server process by sending a crafted Content-Disposition header with an empty field name. Attack
- 7.3 High severity
A flaw has been found in boazsegev facil.io up to 0.7.4.
A flaw has been found in boazsegev facil.io up to 0.7.4. Affected is the function websocket_on_protocol_error in the library lib/facil/http/parsers/websocket_parser.h of the component WebSocket Frame Parser. This manipulation of the argument on_message causes
- 8.7 High severity
facil.io: Uncontrolled Resource Consumption
facil.io is a C micro-framework for web applications. Prior to commit 5128747363055201d3ecf0e29bf0a961703c9fa0, `fio_json_parse` can enter an infinite loop when it encounters a nested JSON value starting with `i` or `I`. The process spins in user space and peg
- 7.5 High severity
Iodine: Improper Limitation of a Pathname to a Restricted Directory
Path traversal in the static file service in Iodine less than 0.7.33 allows an unauthenticated, remote attacker to read files outside the public folder via malicious URLs.