facil.io versions 0.6.0 through 0.7.6 include an integer underflow bug in the multipart MIME body parser. When parsing a POST request that contains a crafted Content-Disposition header with an empty field name, the parser performs a uint32_t wraparound in http_mime_parser.h. This underflow causes an out-of-bounds memory read past the name pointer, triggering a bus fault that crashes the worker handling the request. The vulnerability does not provide code execution or data exfiltration, but it can be leveraged to disrupt service availability.

The vulnerability affects all deployments of facil.io from version 0.6.0 up to and including 0.7.6, released by Boaz Segev. No patch version is listed in the provided data, implying that the affected range remains vulnerable until an updated release is available.

The CVSS score of 8.7 indicates a high severity level. EPSS score is < 1%, and the vulnerability is not listed in CISA’s KEV catalog. Attackers require unauthenticated access to the HTTP interface and the ability to construct a multipart POST request with a malformed Content-Disposition header. A single crafted request can trigger the attack, causing an immediate crash of the handling worker and resulting in a denial of service for that request. No additional prerequisite authentication or privileged access is required, making the threat vector straightforward to exploit.