The vulnerability in facil.io versions 0.7.5 through 0.7.6 is a parser error in the HTTP/1.1 chunked transfer encoding routine. When a malicious client sends a POST request whose Transfer‑Encoding header contains a chunk size prefixed by a minus sign, the parser interprets the value as a large positive integer. This causes an internal state corruption and a read pointer to move into unmapped memory, resulting in a segmentation fault and server crash. The defect is a classic out‑of‑bounds read (CWE‑125) and does not grant code execution or privilege escalation, but it does make the service unavailable to legitimate users.

The affected product is facil.io, specifically releases 0.7.5 and 0.7.6. No further version sub‑details are supplied by the CNA.

The vulnerability receives a CVSS score of 8.7 and is considered a high‑severity denial‑of‑service flaw. EPSS score indicates a very low but nonzero exploitation probability (< 1%). The flaw is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an unauthenticated remote HTTP request using the chunked encoding mechanism. An attacker can send a single crafted request to crash the server intentionally. The impact is a service outage until the application is restarted or replaced.