8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41146

CVE-2026-41146: facil.io and downstream iodine ruby gem vulnerable to uncontrolled resource consumption and loop with unreachable exit condition

facil.io is a C micro-framework for web applications. Prior to commit 5128747363055201d3ecf0e29bf0a961703c9fa0, fio_json_parse can enter an infinite loop when it encounters a nested JSON value starting with i or I. The process spins in user space and pegs one CPU core at ~100% instead of returning a parse error. Because iodine vendors the same parser code, the issue also affects iodine when it parses attacker-controlled JSON. The smallest reproducer I found is [i. The quoted-value form that originally exposed the issue, [""i, reaches the same bug because the parser tolerates missing commas and then treats the trailing i as the start of another value. Commit 5128747363055201d3ecf0e29bf0a961703c9fa0 fixes the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41146

CVE-2026-41146:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
iodine	rubygems	<= 0.7.58

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an infinite loop in the fio_json_parse function, located in the header file lib/facil/fiobj/fio_json_parser.h. The root cause is the failure to check if the file pointer advances after attempting to parse a number. When the parser encounters a standalone 'i' or 'I' (for infinity), the fio_atol function returns without advancing the pointer, but the loop condition does not account for this, causing it to repeat indefinitely.

The patch, found in commit 5128747363055201d3ecf0e29bf0a961703c9fa0, rectifies this by adding a tmp == pos check to ensure progress is made during parsing.

Since fio_json_parse is a static inline function, its code is compiled directly into the calling functions. The vulnerability description and PoC identify several such functions that act as entry points to the vulnerable code:

In facil.io, fiobj_json2obj and fiobj_hash_update_json are public APIs that call the vulnerable parser. A runtime profiler would show these functions consuming excessive CPU during an attack.
In the downstream iodine Ruby gem, which vendors the affected code, the Iodine::JSON.parse method is the entry point. This method calls a C function that uses the same vulnerable parser.

Therefore, all these functions are listed as vulnerable. fio_json_parse contains the flawed logic, while the others are the functions that would appear in a runtime profile when the vulnerability is triggered, making them critical indicators for exploitation.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.