CVE-2026-73232: ffuf denial of service (OOM) via HTTP response decompression bomb
ffuf is a fast web fuzzer written in Go. Prior to 2.2.0, ffuf allows a malicious target server to cause an out-of-memory denial of service because the response size guard in pkg/runner/simple.go checks only the compressed Content-Length while io.ReadAll reads gzip, brotli, deflate, transparently decompressed, or chunked response bodies without a decompressed-size bound. This issue is fixed in version 2.2.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ffufto a version that resolves this vulnerability.Fixed in 2.2.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73232?
The severity of CVE-2026-73232 is high, rated at 7.5.
What type of vulnerability is CVE-2026-73232?
CVE-2026-73232 is a denial of service vulnerability caused by an out-of-memory issue.
How does CVE-2026-73232 occur?
CVE-2026-73232 occurs when ffuf processes a response from a malicious server that uses a decompression bomb.
Which versions of ffuf are affected by CVE-2026-73232?
CVE-2026-73232 affects ffuf versions prior to 2.2.0.
How do I fix CVE-2026-73232?
To fix CVE-2026-73232, upgrade ffuf to version 2.2.0 or later.