PT-2026-63528 · Boazsegev · Facil.Io

Fantasy_2026 · CVE-2026-16632 · Published 2026-07-22 · Updated 2026-07-23

NVD

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

A flaw has been found in boazsegev facil.io up to 0.7.4. Affected is the function websocket on protocol error in the library lib/facil/http/parsers/websocket parser.h of the component WebSocket Frame Parser. This manipulation of the argument on message causes improper input validation. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2026-16632

Affected Products

Facil.Io

References · 7

• 🔥 https://github.com/boazsegev/facil.io/issues/169 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-16632 · Security Note
• https://vuldb.com/cve/CVE-2026-16632 · Note
• https://vuldb.com/vuln/382382 · Note
• https://vuldb.com/submit/860585 · Note
• https://vuldb.com/vuln/382382/cti · Note
• https://github.com/boazsegev/facil.io · Note