CVE-2026-115319: fzf 0.36.0 through 0.74.5 Denial of Service via maskActionContents
fzf 0.36.0 through 0.74.5 contains an inefficient algorithmic complexity vulnerability in maskActionContents that allows local attackers to exhaust the --listen HTTP server through quadratic string concatenation. Attackers can repeatedly send POST bodies of about 1 MB to the unauthenticated localhost port, blocking the single-threaded server for about 30 seconds each time.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Only fzf instances running the --listen HTTP server are exposed. The affected listener is on an unauthenticated localhost port, so the attacker must be able to act locally on the host.
What does an attacker need to do to trigger the issue?
A local attacker with low privileges can repeatedly send POST requests with bodies of about 1 MB to the unauthenticated localhost listener. No user interaction is required.
What is the operational impact?
Each crafted request can block the single-threaded HTTP server for about 30 seconds. Repeated requests can exhaust the server and deny service to its users.
What can be done if an update cannot be applied immediately?
Disable the --listen HTTP server where it is not required. For required listeners, limit access by preventing untrusted local users or processes from sending requests to the localhost port.