CVE-2026-73232
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
ffuf, a fast web fuzzer written in Go, prior to version 2.2.0 allows a malicious target server to cause an out-of-memory denial of service because the response size guard checks only the compressed Content-Length while io.ReadAll reads gzip, brotli, deflate, transparently decompressed, or chunked response bodies without a decompressed-size bound.
Risk Assessment
An attacker can cause memory exhaustion and crash the ffuf tool, potentially disrupting security testing or operations.
Recommendation
Update ffuf to version 2.2.0 or later, which fixes this vulnerability. Additionally, limit response sizes and monitor memory usage.
Original NVD description (English source)
ffuf is a fast web fuzzer written in Go. Prior to 2.2.0, ffuf allows a malicious target server to cause an out-of-memory denial of service because the response size guard in pkg/runner/simple.go checks only the compressed Content-Length while io.ReadAll reads gzip, brotli, deflate, transparently decompressed, or chunked response bodies without a decompressed-size bound. This issue is fixed in version 2.2.0.