PT-2026-34238 · Iodine+1 · Iodine+1

Published 2026-04-14 · Updated 2026-04-25 · CVE-2026-41146

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions facil.io versions prior to commit 5128747363055201d3ecf0e29bf0a961703c9fa0 iodine (affected versions not specified)

Description The fio json parse() function can enter an infinite loop when encountering a nested JSON value that starts with the character i or I. This causes the process to consume approximately 100% of a CPU core's resources instead of returning a parse error. This issue occurs because the parser may tolerate missing commas and treat trailing characters as the start of a new value.

Recommendations Update to commit 5128747363055201d3ecf0e29bf0a961703c9fa0 or a newer version. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Infinite Loop

Resource Exhaustion

Weakness Enumeration

CWE-835

CWE-400

Related Identifiers

CVE-2026-41146

GHSA-2X79-GWQ3-VXXM

Affected Products

Facil.Io

Iodine

References · 7

• 🔥 https://github.com/boazsegev/facil.io/security/advisories/GHSA-2x79-gwq3-vxxm · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/iodine/CVE-2026-41146.yml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-41146 · Security Note
• https://osv.dev/vulnerability/GHSA-2x79-gwq3-vxxm · Vendor Advisory
• https://github.com/boazsegev/facil.io/commit/5128747363055201d3ecf0e29bf0a961703c9fa0 · Note
• https://github.com/boazsegev/facil.io · Note
• https://twitter.com/CVEnew/status/2048168393103294641 · Twitter Post