What’s Vulnerable › Vulnerabilities

CVE-2026-115319: fzf 0.36.0 through 0.74.5 Denial of Service via maskActionContents

• Severity: low (CVSS 2.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-22 · updated 2026-10-29
• Weakness: CWE-407

Description

fzf 0.36.0 through 0.74.5 contains an inefficient algorithmic complexity vulnerability in maskActionContents that allows local attackers to exhaust the --listen HTTP server through quadratic string concatenation. Attackers can repeatedly send POST bodies of about 1 MB to the unauthenticated localhost port, blocking the single-threaded server for about 30 seconds each time.

Affected products

• fzf: from 0.36.0 through 0.74.5

References

• https://github.com/junegunn/fzf
• https://github.com/junegunn/fzf/blob/v0.74.5/src/options.go#L1680-L1736
• https://github.com/junegunn/fzf/commit/b412a450538e5f4a1d7057732e75d945dafa18a6
• https://www.vulncheck.com/advisories/fzf-0.36.0-through-0.74.5-denial-of-service-via-maskactioncontents

Get alerted when CVE-2026-115319 or the next vulnerability affects your stack