Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-16632: Facil.io WebSocket Frame Parser Input Validation Flaw

CVE-2026-16632 · published 3 months ago

Summary

A flaw in the Facil.io WebSocket Frame Parser allows attackers to manipulate input remotely. This can be exploited to potentially cause harm. Users should consider updating to a fixed version of Facil.io as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
boazsegev	facil.io	0.7.0

Original advisory text

boazsegev facil.io WebSocket Frame websocket_parser.h websocket_on_protocol_error input validation

A flaw has been found in boazsegev facil.io up to 0.7.4. Affected is the function websocket_on_protocol_error in the library lib/facil/http/parsers/websocket_parser.h of the component WebSocket Frame Parser. This manipulation of the argument on_message causes improper input validation. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

References

https://github.com/boazsegev/facil.io/ URL
https://vuldb.com/cve/CVE-2026-16632 Vendor Advisory
https://vuldb.com/submit/860585 Vendor Advisory
https://vuldb.com/vuln/382382 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/16xxx/CVE-2026-16632... Vendor Advisory
https://github.com/boazsegev/facil.io/issues/169 Third Party Advisory
https://vuldb.com/vuln/382382/cti Third Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-16632 Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

8.4 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-20Improper Input Validation

Timeline

Published22 Jul 2026

Updated4 Nov 2026

First seen23 Jul 2026

Sources

CVE-2026-16632 · NVD

CVE-2026-16632 · MITRE

CVE-2026-16632 · OSV

Track software like this

Free during beta