Disclosure summary
fzf is vulnerable to a Denial of Service (DoS) due to inefficient HTTP body processing in the --listen mode due to inefficient HTTP body processing using repeated string concatenation, resulting in quadratic time complexity (O(n²)). A crafted POST request with many small segments can trigger excessive CPU usage during request handling.This allows a single malicious request to monopolize the single‑threaded HTTP server, blocking all other clients and resulting in denial of service. This issue was fixed in version 0.73.1.
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
GitHub Reviewed Security Advisories · GHSA-mvmf-94v6-879g
Open original source · Updated Sep 30, 2026
fzf vulnerable to denial of service through quadratic HTTP request-body accumulation
Source severity: MEDIUM / 5.7
| Ecosystem | Package | Affected range | First patched |
|---|---|---|---|
| go | github.com/junegunn/fzf | < 0.73.1 | 0.73.1 |
Original records & references
- NIST NVD record
- CVE Program record
- github.com — Reviewed advisory
PUBLISHED 2026-06-30T11:30:44-04:00
MODIFIED 2026-09-30T19:52:48-04:00
INGESTED 2026-10-06T11:45:02-04:00