CVE-2026-115319
LowCVSS 2.5Summary
fzf versions 0.36.0 through 0.74.5 contain an inefficient algorithmic complexity vulnerability in maskActionContents that lets local attackers exhaust the --listen HTTP server via quadratic string concatenation. Repeatedly sending ~1 MB POST bodies to the unauthenticated localhost port blocks the single-threaded server for about 30 seconds each time.
Risk Assessment
A local attacker can cause denial of service for the fzf --listen server, blocking its availability. Risk applies to environments running fzf as a listening server.
Recommendation
Upgrade fzf to a version containing a fix or restrict access to the --listen port. Consider disabling --listen mode if not needed.
Other vulnerabilities in fzf
See all- CVE-2026-53433High
A vulnerability in fzf's --listen mode causes a Denial of Service (DoS) due to inefficient HTTP body processing using repeated string concatenation, resulting in quadratic time complexity (O(n²)). A crafted POST request with many small segments can trigger excessive CPU usage, monopolizing the single-threaded HTTP server and blocking all other clients.
- CVE-2026-53432High
An integer overflow vulnerability was discovered in the fzf tool within the FuzzyMatchV2 function. When the input line length is approximately 2,200,000 bytes and the pattern length is 999 bytes, an overflow occurs, leading to invalid slice bounds. The Go runtime detects this and immediately terminates the process with a non-recoverable panic.
Original NVD description (English source)
fzf 0.36.0 through 0.74.5 contains an inefficient algorithmic complexity vulnerability in maskActionContents that allows local attackers to exhaust the --listen HTTP server through quadratic string concatenation. Attackers can repeatedly send POST bodies of about 1 MB to the unauthenticated localhost port, blocking the single-threaded server for about 30 seconds each time.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS