Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-115319: fzf can be stopped by sending large local requests

CVE-2026-115319 · published 13 days ago

Summary

The fzf command‑line tool (versions 0.36.0 to 0.74.5) runs a small built‑in web server that listens on localhost. A local user can flood this server with about 1 MB POST requests, causing the server to freeze for around half a minute each time. To protect your system, upgrade to a newer version of fzf or disable the --listen option if you do not need it.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	junegunn	fzf	<= 0.74.5
Debian:12	debian	fzf	All versions

Original advisory text

fzf 0.36.0 through 0.74.5 Denial of Service via maskActionContents

fzf 0.36.0 through 0.74.5 contains an inefficient algorithmic complexity vulnerability in maskActionContents that allows local attackers to exhaust the --listen HTTP server through quadratic string concatenation. Attackers can repeatedly send POST bodies of about 1 MB to the unauthenticated localhost port, blocking the single-threaded server for about 30 seconds each time.

References

https://www.vulncheck.com/advisories/fzf-0.36.0-through-0.74.5-denial-of-service... Vendor Advisory
https://github.com/junegunn/fzf/commit/b412a450538e5f4a1d7057732e75d945dafa18a6 Patch
https://github.com/junegunn/fzf Product
https://github.com/junegunn/fzf/blob/v0.74.5/src/options.go#L1680-L1736 Third Party Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-1153... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-115319 Vendor Advisory
https://security-tracker.debian.org/tracker/CVE-2026-115319 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.3 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-407Inefficient Algorithmic Complexity

Timeline

Published22 Oct 2026

Updated31 Oct 2026

First seen22 Oct 2026

Sources

CVE-2026-115319 · NVD

CVE-2026-115319 · MITRE

CVE-2026-115319 · OSV

DEBIAN-CVE-2026-115319 · OSV

Track software like this

Free during beta