CVE-2026-53433: Denial of Service in fzf
fzf is vulnerable to a Denial of Service (DoS) due to inefficient HTTP body processing in the --listen mode due to inefficient HTTP body processing using repeated string concatenation, resulting in quadratic time complexity (O(n²)). A crafted POST request with many small segments can trigger excessive CPU usage during request handling.This allows a single malicious request to monopolize the single‑threaded HTTP server, blocking all other clients and resulting in denial of service.
This issue was fixed in version 0.73.1.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53433?
CVE-2026-53433 is classified as a risk level of 28, indicating a moderate severity Denial of Service vulnerability.
How do I fix CVE-2026-53433?
To fix CVE-2026-53433, update fzf to the latest version where the vulnerability has been addressed in the code.
What impact does CVE-2026-53433 have on fzf?
CVE-2026-53433 can cause a Denial of Service in fzf through inefficient handling of HTTP requests in listen mode.
Is CVE-2026-53433 easy to exploit?
Yes, CVE-2026-53433 can be exploited by sending crafted POST requests with many small segments to trigger the vulnerability.
What is the nature of the vulnerability in CVE-2026-53433?
CVE-2026-53433 involves inefficient HTTP body processing due to repeated string concatenation leading to quadratic time complexity.