An infinite loop vulnerability in the facil.io MIME parser allows unauthenticated attackers to consume system resources and crash the service, resulting in a denial of service.

This vulnerability is an infinite loop (CWE-835) within the MIME parser. The flaw allows an unauthenticated remote attacker to cause the application to enter an unreachable exit condition, leading to resource exhaustion and service instability.

The ability to remotely trigger an infinite loop poses a severe risk to service availability. With a CVSS score of 7.5, this vulnerability represents a high risk, as it allows attackers to disrupt critical business operations without requiring any prior authentication or special privileges.

Immediate Action: Monitor the vendor for the release of a security patch addressing the MIME parser infinite loop and apply the update immediately upon availability.

Proactive Monitoring: Monitor server CPU and memory usage for sudden spikes, which may indicate that an attacker is triggering an infinite loop within the MIME parser.

Compensating Controls: Implement rate limiting and strict MIME header validation on the WAF to mitigate the impact of malicious requests attempting to trigger the loop.

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub.

Given the ease of exploitation and the potential for complete service disruption, this issue must be handled with high priority. Ensure that all facil.io deployments are isolated from untrusted input where possible and verify that your security team is prepared to deploy the upcoming vendor fix.