CVE-2026-16632

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-16632
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-16632.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-16632
Published
2026-07-22T23:45:10.246Z
Modified
2026-08-12T03:51:17.100003316Z
Severity
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
boazsegev facil.io WebSocket Frame websocket_parser.h websocket_on_protocol_error input validation
Details

A flaw has been found in boazsegev facil.io up to 0.7.4. Affected is the function websocketonprotocolerror in the library lib/facil/http/parsers/websocketparser.h of the component WebSocket Frame Parser. This manipulation of the argument on_message causes improper input validation. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/16xxx/CVE-2026-16632.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "0.7.4"
                },
                {
                    "last_affected": "0.7.4"
                }
            ]
        }
    ],
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-20"
    ]
}
References

Affected packages

Git / github.com/boazsegev/facil.io

Affected ranges

Type
GIT
Repo
https://github.com/boazsegev/facil.io
Events
Introduced
f077be5d00c9b19375121a613b142d3c76a6b992
Last affected
f264eb5dd090c0e447c20c06fe857afd2f30ac48
Database specific
Show details 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0.7.0"
        },
        {
            "last_affected": "0.7.0"
        },
        {
            "introduced": "0.7.1"
        },
        {
            "last_affected": "0.7.1"
        },
        {
            "introduced": "0.7.2"
        },
        {
            "last_affected": "0.7.2"
        },
        {
            "introduced": "0.7.3"
        },
        {
            "last_affected": "0.7.3"
        }
    ]
}

Affected versions

0.*
0.7.0
0.7.1
0.7.2
0.7.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-16632.json"