CVE-2026-16632 | A flaw has been found in boazsegev facil.io up to 0.7.4. Aff… | CVSS 7.3 HIGH

Description

A flaw has been found in boazsegev facil.io up to 0.7.4. Affected is the function websocket_on_protocol_error in the library lib/facil/http/parsers/websocket_parser.h of the component WebSocket Frame Parser. This manipulation of the argument on_message causes improper input validation. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Metadata

CVE ID: CVE-2026-16632
State: PUBLISHED
Assigner: VulDB
Reserved: 2026-07-22 16:13 UTC
Published: 2026-07-22 23:45 UTC
Last updated: 2026-07-22 23:45 UTC
Primary CWE: CWE-20
Improper Input Validation
Vendor / Product: boazsegev / facil.io
Sources: cve.org · NVD

Severity & Metrics

7.3 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Affected products (1)

Vendor	Product	Platform	Versions
boazsegev	facil.io	—	0.7.0, 0.7.1, 0.7.2, 0.7.3 …

Weakness (CWE)

CWE	Source	Description
CWE-20	cna	Improper Input Validation

CVSS scores (4)

Score	Severity	Version	Source	Vector
7.5	N/D	2.0	cna	AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
7.3	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
7.3	HIGH	3.0	cna	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
6.9	MEDIUM	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

References (6)

VDB-382382 | boazsegev facil.io WebSocket Frame websocket_parser.h websocket_on_protocol_error input validation https://vuldb.com/vuln/382382
VDB-382382 | CTI Indicators (IOB, IOC, IOA) https://vuldb.com/vuln/382382/cti
CVE-2026-16632 | CVE Analysis and Report https://vuldb.com/cve/CVE-2026-16632
Submit #860585 | facil.io <= 0.7.4 Improper Input Validation https://vuldb.com/submit/860585
https://github.com/boazsegev/facil.io/issues/169
https://github.com/boazsegev/facil.io/