{"id":"CVE-2026-41146","summary":"facil.io and downstream iodine ruby gem vulnerable to uncontrolled resource consumption and loop with unreachable exit condition","details":"facil.io is a C micro-framework for web applications. Prior to commit 5128747363055201d3ecf0e29bf0a961703c9fa0, `fio_json_parse` can enter an infinite loop when it encounters a nested JSON value starting with `i` or `I`. The process spins in user space and pegs one CPU core at ~100% instead of returning a parse error. Because `iodine` vendors the same parser code, the issue also affects `iodine` when it parses attacker-controlled JSON. The smallest reproducer I found is `[i`. The quoted-value form that originally exposed the issue, `[\"\"i`, reaches the same bug because the parser tolerates missing commas and then treats the trailing `i` as the start of another value. Commit 5128747363055201d3ecf0e29bf0a961703c9fa0 fixes the issue.","aliases":["GHSA-2x79-gwq3-vxxm"],"modified":"2026-07-08T08:05:12.037894883Z","published":"2026-04-22T01:07:28.660Z","database_specific":{"cna_assigner":"GitHub_M","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41146.json","unresolved_ranges":[{"source":"AFFECTED_FIELD","extracted_events":[{"fixed":"5128747363055201d3ecf0e29bf0a961703c9fa0"},{"fixed":"0.7.59"}]}],"cwe_ids":["CWE-400","CWE-835"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41146.json"},{"type":"ADVISORY","url":"https://github.com/boazsegev/facil.io/security/advisories/GHSA-2x79-gwq3-vxxm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41146"},{"type":"FIX","url":"https://github.com/boazsegev/facil.io/commit/5128747363055201d3ecf0e29bf0a961703c9fa0"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/boazsegev/facil.io","events":[{"introduced":"0"},{"fixed":"5128747363055201d3ecf0e29bf0a961703c9fa0"}],"database_specific":{"source":"REFERENCES"}}],"versions":["0.7.5","0.7.3","0.7.2","0.7.0","0.7.0.beta8","0.7.0.beta7","0.7.0.beta6","0.7.0.beta5","0.7.0.beta4","0.7.0.beta3","0.7.0.beta2","0.7.0.beta1","0.6.4","0.6.3","0.6.2","0.6.1","0.6.0","0.6.0.beta.8","0.6.0.beta.7","0.6.0.beta.6","0.6.0.beta.5","0.6.0.beta.4","0.6.0.beta.3","0.6.0.beta.2","0.6.0.beta","0.6.0.dev","0.5.8","0.5.7","0.5.6","0.5.5","0.5.4","0.5.2","0.5.1","0.5.0","0.4.4","0.4.3","0.4.2","0.4.1","0.3.2","0.3.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41146.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}