p PatchFirst

CVE-2026-115319

CVE-2026-115319 · fzf 0.36.0 through 0.74.5 Denial of Service via maskActionContents

This page contains facts from public vulnerability sources. Check the original advisory before updating.

fzf 0.36.0 through 0.74.5 contains an inefficient algorithmic complexity vulnerability in maskActionContents that allows local attackers to exhaust the --listen HTTP server through quadratic string concatenation. Attackers can repeatedly send POST bodies of about 1 MB to the unauthenticated localhost port, blocking the single-threaded server for about 30 seconds each time.

CVSS 2.0 · Low · EPSS 0.1%

Published
Updated

Stack: system

Affected products and versions

  • fzf

    Versions
    • ≥ 0.36.0, ≤ 0.74.5: Affected (semver)

    No fix published

  • fzf Debian:12

    Versions
    • 0.38.0-1
    • 0.42.0-1
    • 0.44.1-1
    • 0.46.1-1
    • 0.55.0-1
    • 0.56.3-1
    • 0.57.0-1
    • 0.58.0-1
    • 0.60.0-1
    • 0.60.1-1
    • 0.60.2-1
    • 0.60.3-1
    • 0.64.0-1
    • 0.65.1-1
    • 0.66.0-1
    • 0.67.0-1
    • 0.70.0-1
    • 0.72.0-1
    • 0.73.1-1
    • 0.74.1-1
    • 0.74.3-1
    • 0.74.4-1
    • 0.74.5-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • fzf Debian:13

    Versions
    • 0.60.3-1
    • 0.64.0-1
    • 0.65.1-1
    • 0.66.0-1
    • 0.67.0-1
    • 0.70.0-1
    • 0.72.0-1
    • 0.73.1-1
    • 0.74.1-1
    • 0.74.3-1
    • 0.74.4-1
    • 0.74.5-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • fzf Debian:14

    Versions
    • 0.60.3-1
    • 0.64.0-1
    • 0.65.1-1
    • 0.66.0-1
    • 0.67.0-1
    • 0.70.0-1
    • 0.72.0-1
    • 0.73.1-1
    • 0.74.1-1
    • 0.74.3-1
    • 0.74.4-1
    • 0.74.5-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • fzf Ubuntu:20.04:LTS

    Versions
    • 0.18.0-2
    • 0.18.0-3
    • 0.19.0-1
    • 0.20.0-1
    • 0.20.0-1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • fzf Ubuntu:22.04:LTS

    Versions
    • 0.24.3-1
    • 0.29.0-1
    • 0.29.0-1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • fzf Ubuntu:24.04:LTS

    Versions
    • 0.42.0-1build1
    • 0.44.1-1
    • 0.44.1-1ubuntu0.1
    • 0.44.1-1ubuntu0.2
    • 0.44.1-1ubuntu0.3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • fzf Ubuntu:26.10

    Versions
    • 0.67.0-1
    • 0.72.0-1
    • 0.73.1-1
    • 0.74.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • fzf Ubuntu:26.04:LTS

    Versions
    • 0.60.3-1
    • 0.66.0-1
    • 0.67.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →