A memory corruption vulnerability in the facil.io HTTP chunked parser allows unauthenticated attackers to crash the server, causing significant service disruption.

This is an out-of-bounds read vulnerability (CWE-125) triggered by negative chunk size values in the HTTP chunked transfer encoding parser. An unauthenticated remote attacker can exploit this to corrupt memory and force a server crash.

The vulnerability enables remote attackers to crash the service, leading to unplanned downtime. With a CVSS score of 7.5, this issue is rated as high severity, and it could significantly impact the reliability and availability of systems that rely on facil.io for HTTP handling.

Immediate Action: Track the official vendor advisory for the release of a patch that properly validates chunk sizes and apply it as soon as it becomes available.

Proactive Monitoring: Review web server access logs for anomalous HTTP chunked transfer requests that might indicate an attempt to exploit the parser.

Compensating Controls: Configure the WAF to strictly inspect and reject HTTP requests that contain invalid or negative values in chunked transfer encoding headers.

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub.

This vulnerability presents a clear risk to system availability through memory corruption. Security teams should prioritize patching this component as soon as the vendor provides a fix and should rely on edge security controls to filter potentially malicious chunked transfer requests in the interim.