The multipart body parser in facil.io versions 0.6.0 through 0.7.6 has a flaw where a missing progress guard in the parsing loop causes the function http_mime_parse to return zero bytes consumed without setting completion or error flags. This leads to the parser being repeatedly invoked on the same buffer indefinitely, resulting in an infinite loop that exhausts all worker processes and disables the server. The vulnerability can be triggered remotely without authentication by sending a multipart/form-data request with a partial closing boundary.

Successful exploitation results in a denial-of-service condition by permanently freezing all worker processes at 100% CPU utilization. This disables the server until it is manually restarted, causing service disruption. There is no indication of data compromise or privilege escalation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider implementing network-level protections to block or limit suspicious multipart/form-data requests that could trigger this condition. Manual server restarts are required to recover from the denial-of-service state.