The vulnerability resides in facil.io’s `fio_json_parse` function. When it encounters a nested JSON value that begins with the letter 'i' or 'I', the parser falls into an infinite loop. This unbounded loop consumes CPU resources, pegging a core at 100 % and preventing the process from returning a parse error. The effect is an uncontrolled resource consumption that results in denial of service. The flaw maps to CWE‑400 and CWE‑835.

Both the facil.io C micro‑framework and the iodine Ruby gem share the same parsing logic. Any installation of facil.io or iodine that predates commit 5128747363055201d3ecf0e29bf0a961703c9fa0 is vulnerable. The issue manifests for any JSON payload that includes a nested value starting with 'i' or 'I', the smallest reproducer being `[i`. This affects all deployments that accept attacker‑controlled JSON input through facil.io or iodine.

The CVSS score of 8.7 indicates a high severity vulnerability. Exploitation requires the attacker to send a crafted JSON request to an application that uses the vulnerable parser, a condition that is likely met in publicly accessible services. The lack of an EPSS score and absence from the KEV catalog do not diminish the risk; the bug is reproducible and surfaces as an immediate denial of service once the payload reaches the parser. Attackers could cause CPU exhaustion with zero privileged access, making the vulnerability highly actionable.