Infinite Loop in facil.io C Micro-Framework Affecting JSON Parsing

CVE-2026-41146

What is CVE-2026-41146?

The facil.io framework, a popular C micro-framework for web applications, contains a vulnerability in its JSON parser. Specifically, prior to the implementation of a critical commit, the fio_json_parse function can enter an infinite loop when parsing nested JSON values that start with the letter 'i' or 'I'. This flaw results in resource exhaustion, causing one CPU core to run at near 100% utilization without generating a proper parsing error. The issue extends to the iodine framework, which incorporates the same parser code, allowing an attacker to exploit this flaw through crafted JSON inputs. The vulnerability is addressed in commit 5128747363055201d3ecf0e29bf0a961703c9fa0.

References