Approved changes feed: RSS · Atom
cpe:2.3:a:boazsegev:iodine:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Boazsegev (35430723-2ac5-58fd-b145-bb91cf333779) |
|---|---|
| Product | Iodine (c40901af-7790-5591-b10b-aae97f6571d7) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:gem/iodine |
purl2cpe | 2026-06-01 10:11:15.780454 |
pkg:github/boazsegev/iodine |
purl2cpe | 2026-06-01 10:11:15.780457 |
pkg:sourceforge/iodine |
purl2cpe | 2026-06-01 10:11:15.780460 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-41146 |
vulnerable | 2026-06-08 08:03:14.969749 |
facil.io and downstream iodine ruby gem vulnerable to uncontrolled resource consumption and loop with unreachable exit condition
facil.io is a C micro-framework for web applications. Prior to commit 5128747363055201d3ecf0e29bf0a961703c9fa0, `fio_json_parse` can enter an infinite loop when it encounters a nested JSON value starting with `i` or `I`. The process spins in user space and pegs one CPU core at ~100% instead of returning a parse error. Because `iodine` vendors the same parser code, the issue also affects `iodine` when it parses attacker-controlled JSON. The smallest reproducer I found is `[i`. The quoted-value form that originally exposed the issue, `[""i`, reaches the same bug because the parser tolerates missing commas and then treats the trailing `i` as the start of another value. Commit 5128747363055201d3ecf0e29bf0a961703c9fa0 fixes the issue.
Published: 2026-04-22T01:07:28.660Z
Updated: 2026-04-22T13:09:38.075Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.