The vulnerability CVE-2026-16632 affects the websocket_on_protocol_error function in the lib/facil/http/parsers/websocket_parser.h file of boazsegev facil.io versions 0.7.0 through 0.7.4. Improper input validation of the on_message argument in the WebSocket Frame Parser component can be triggered remotely. The issue was reported early to the project, but no remediation or patch has been issued as of the publication date. Exploit code is publicly available, increasing the risk of exploitation.

Successful exploitation of this vulnerability can lead to improper handling of WebSocket protocol errors, potentially allowing remote attackers to cause unexpected behavior or denial of service. The CVSS 4.0 base score of 6.9 reflects a medium severity with network attack vector, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability.

No official fix or patch is currently available from the vendor. Users should monitor the vendor's advisories for updates. Until a patch is released, consider applying workarounds such as disabling or restricting WebSocket usage if feasible, or implementing network-level protections to limit exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.