CVE-2026-16632
boazsegev facil.io WebSocket Frame websocket_parser.h websocket_on_protocol_error input validation
- State
- Published
- Severity
- 6.9 Medium
- Published
- Jul 22, 2026
- Updated
- Jul 23, 2026
- Reserved
- Jul 22, 2026
Description
A flaw has been found in boazsegev facil.io up to 0.7.4. Affected is the function websocket_on_protocol_error in the library lib/facil/http/parsers/websocket_parser.h of the component WebSocket Frame Parser. This manipulation of the argument on_message causes improper input validation. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 7.3 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 7.3 High | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 7.5 High | AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
- CWE-20 Improper Input Validation
Affected Products
| Product | Versions |
|---|---|
facil.ioboazsegev |
|
References
- VDB-382382 | boazsegev facil.io WebSocket Frame websocket_parser.h websocket_on_protocol_error input validationvdb-entrytechnical-description
- VDB-382382 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- CVE-2026-16632 | CVE Analysis and Reportthird-party-advisory
- Submit #860585 | facil.io <= 0.7.4 Improper Input Validationthird-party-advisory
- https://github.com/boazsegev/facil.io/issues/169exploitissue-tracking
- https://github.com/boazsegev/facil.io/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.