p PatchFirst

CVE-2026-53433

CVE-2026-53433 · Denial of Service in fzf

This page contains facts from public vulnerability sources. Check the original advisory before updating.

fzf is vulnerable to a Denial of Service (DoS) due to inefficient HTTP body processing in the --listen mode due to inefficient HTTP body processing using repeated string concatenation, resulting in quadratic time complexity (O(n²)). A crafted POST request with many small segments can trigger excessive CPU usage during request handling.This allows a single malicious request to monopolize the single‑threaded HTTP server, blocking all other clients and resulting in denial of service. This issue was fixed in version 0.73.1.

CVSS 5.7 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • fzf

    Versions
    • ≥ 0, < 0.73.1: Affected (semver)

    Update to 0.73.1

  • fzf Debian:12

    Versions
    • 0.38.0-1
    • 0.42.0-1
    • 0.44.1-1
    • 0.46.1-1
    • 0.55.0-1
    • 0.56.3-1
    • 0.57.0-1
    • 0.58.0-1
    • 0.60.0-1
    • 0.60.1-1
    • 0.60.2-1
    • 0.60.3-1
    • 0.64.0-1
    • 0.65.1-1
    • 0.66.0-1
    • 0.67.0-1
    • 0.70.0-1
    • 0.72.0-1
    • 0.73.1-1
    • 0.74.1-1
    • 0.74.3-1
    • 0.74.4-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • fzf Debian:13

    Versions
    • 0.60.3-1
    • 0.64.0-1
    • 0.65.1-1
    • 0.66.0-1
    • 0.67.0-1
    • 0.70.0-1
    • 0.72.0-1
    • 0.73.1-1
    • 0.74.1-1
    • 0.74.3-1
    • 0.74.4-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • fzf Debian:14

    Versions
    • 0.60.3-1
    • 0.64.0-1
    • 0.65.1-1
    • 0.66.0-1
    • 0.67.0-1
    • 0.70.0-1
    • 0.72.0-1
    Affected ranges
    • ECOSYSTEM: < 0.73.1-1

    Update to 0.73.1-1

  • fzf Ubuntu:20.04:LTS

    Versions
    • 0.18.0-2
    • 0.18.0-3
    • 0.19.0-1
    • 0.20.0-1
    • 0.20.0-1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • fzf Ubuntu:22.04:LTS

    Versions
    • 0.24.3-1
    • 0.29.0-1
    • 0.29.0-1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • fzf Ubuntu:24.04:LTS

    Versions
    • 0.42.0-1build1
    • 0.44.1-1
    • 0.44.1-1ubuntu0.1
    • 0.44.1-1ubuntu0.2
    • 0.44.1-1ubuntu0.3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • fzf Ubuntu:25.10

    Versions
    • 0.60.3-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • fzf Ubuntu:26.04:LTS

    Versions
    • 0.60.3-1
    • 0.66.0-1
    • 0.67.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →