CVE-2026-41146

facil.io is a C micro-framework for web applications. Prior to commit 5128747363055201d3ecf0e29bf0a961703c9fa0, `fio_json_parse` can enter an infinite loop when it encounters a nested JSON value starting with `i` or `I`. The process spins in user space and pegs one CPU core at ~100% instead of returning a parse error. Because `iodine` vendors the same parser code, the issue also affects `iodine` when it parses attacker-controlled JSON. The smallest reproducer I found is `[i`. The quoted-value form that originally exposed the issue, `[""i`, reaches the same bug because the parser tolerates missing commas and then treats the trailing `i` as the start of another value. Commit 5128747363055201d3ecf0e29bf0a961703c9fa0 fixes the issue.

• CWE-400
• CWE-835

• https://github.com/boazsegev/facil.io/commit/5128747363055201d3ecf0e29bf0a961703c9fa0
• https://github.com/boazsegev/facil.io/security/advisories/GHSA-2x79-gwq3-vxxm
• https://github.com/boazsegev/facil.io/security/advisories/GHSA-2x79-gwq3-vxxm

Published

Apr 22, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41140Poetry is a dependency manager for Python. Prior to 2.3.4, t…8.7
• CVE-2026-41141EspoCRM is an open source customer relationship management a…6.5
• CVE-2026-41142OpenEXR provides the specification and reference implementat…8.8
• CVE-2026-41143YesWiki is a wiki system written in PHP. Prior to version 4.…8.8
• CVE-2026-41144F´ (F Prime) is a framework that enables development and dep…9.8
• CVE-2026-41145MinIO is a high-performance object storage system. Starting …8.2
• CVE-2026-41147NukeViet CMS is a multi Content Management System. Versions …8.7
• CVE-2026-41148Mermaid is a JavaScript tool that uses Markdown-inspired tex…5.3
• CVE-2026-41149Mermaid is a JavaScript tool that uses Markdown-inspired tex…5.3
• CVE-2026-4115A vulnerability was detected in PuTTY 0.83. Affected is the …3.7
• CVE-2026-41150Mermaid is a JavaScript tool that uses Markdown-inspired tex…5.3
• CVE-2026-41153In JetBrains Junie before 252.549.29 command execution was p…9.8