EUVD-2026-108122
GHSA-9q8r-c9q4-p63h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local account on host
-
ExploitSend ~1 MB POST to --listen localhost port
-
ExecutionTrigger O(n^2) action parsing in maskActionContents
-
ImpactBlock single-threaded server ~30s (repeat to sustain)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Algorithmic complexity limits
|
| Exploitation Conditions | fzf must be launched with the --listen HTTP server mode active (a non-default, opt-in feature), and the attacker must have local access to the host to reach the localhost-bound port, which has no application-layer authentication. Affected versions are 0.36.0 through 0.74.5. Limiting factors that reduce real-world risk: the --listen mode is rarely enabled, local access is required, the impact is only a temporary (~30s) stall of that single-threaded server per request rather than a persistent or system-wide outage, and there is no confidentiality or integrity effect. |
| Impact | All decision signals agree this is a genuinely low-priority issue, not a high-CVSS-but-low-risk mislabel. The CVSS 4.0 base score is 2.0 (Low) with a local vector (AV:L), low privileges required (PR:L), an attack requirement present (AT:P), and availability-only impact (VA:L) - no confidentiality or integrity effect. The vuln.today Decision label is 'monitor', the lowest urgency tier, consistent with the score. No CISA KEV listing is present, so there is no confirmed active exploitation; no EPSS score was supplied in the input, so exploitation-probability cannot be quantified here; and no public exploit is identified at time of analysis (the VulnCheck advisory and patch commit are references, not verified working exploit code). One tension to verify: the description calls the --listen port 'unauthenticated', yet the vector assigns PR:L - these reconcile because reaching the localhost port still requires a local account on the host, so the 'unauthenticated' refers to the absence of application-layer auth on the port rather than to remote anonymous access. Impact is a temporary (~30s) stall of a single-threaded, non-default developer service, not a system-wide outage. |
| Exploit ScenarioDerived | On a host where fzf is run with the --listen HTTP server enabled, a local user repeatedly sends ~1 MB POST bodies to the unauthenticated localhost port. Each request triggers quadratic string concatenation in maskActionContents, blocking the single-threaded server for about 30 seconds and denying the listen API to legitimate callers. No public exploit is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 22, 2026
The fzf fuzzy finder (0.36.0 through 0.74.5) builds its masked action string with repeated string concatenation in maskActionContents, giving quadratic runtime in the size of the supplied action text, so a local user can stall the opt-in --listen HTTP server by repeatedly POSTing bodies of roughly 1 MB to the unauthenticated localhost port, blocking the single-threaded server for about 30 seconds per request. Exploitation requires fzf to be running with --listen enabled (a non-default, opt-in feature) and local reachability of the localhost-bound port; the impact is a temporary stall of that server with no confidentiality or integrity effect, and no public exploit was identified at time of analysis. Severity is low (CVSS 4.0 base score 2.0; assessed CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L), and the priority signals converge on routine monitoring rather than urgent action.
RemediationAI
Apply the upstream fix commit b412a450538e5f4a1d7057732e75d945dafa18a6 (https://github.com/junegunn/fzf/commit/b412a450538e5f4a1d7057732e75d945dafa18a6), which converts the quadratic string concatenation in maskActionContents to a strings.Builder; the provided data confirms the fix upstream but does not confirm a specific tagged release version containing it, so verify the release notes for the build you deploy before upgrading. If the patched build cannot be deployed, the most direct mitigation is to avoid running fzf with --listen, since the feature is off by default and is the only path to maskActionContents - the trade-off is that any scripts or tooling relying on the HTTP control interface will stop working. Additionally, since the listener is bound to localhost and requires local reachability, limiting which local accounts or processes can reach that port reduces exposure, at the cost of breaking legitimate local clients that drive the running instance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
fzf is a Go command-line fuzzy finder; its --listen mode exposes a small HTTP server that accepts action strings (for example via POST bodies) to programmatically drive the running instance. The vulnerable routine, maskActionContents in src/options.go (lines ~1680-1736 in v0.74.5), walks the action string and appends to a result string with masked += ... inside the loop; because each append copies the already-accumulated string, the total work grows quadratically with input length (CWE-407, inefficient algorithmic complexity). With a ~1 MB request body the parsing work becomes large enough to hold the single-threaded HTTP server for roughly 30 seconds, and because the listener processes requests serially, other clients are blocked for that period. The upstream fix commit b412a450538e5f4a1d7057732e75d945dafa18a6 replaces the concatenation with a strings.Builder and writes each segment into it, making the operation linear; the accompanying CHANGELOG entry explicitly describes the fix as eliminating O(n^2) action parsing in --listen. The public tags label the issue as information disclosure, but no confidentiality impact is described in the source material or the assessed vector, which scores availability only; the trigger conditions beyond the --listen request path and body size are not further detailed in the available sources.
Know when Fzf gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Localhost --listen port requires a local account (AV:L, PR:L); only temporary degradation of the single fzf server yields A:L; no confidentiality or integrity impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
fzf 0.36.0 through 0.74.5 contains an inefficient algorithmic complexity vulnerability in maskActionContents that allows local attackers to exhaust the --listen HTTP server through quadratic string concatenation. Attackers can repeatedly send POST bodies of about 1 MB to the unauthenticated localhost port, blocking the single-threaded server for about 30 seconds each time.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Denial of service in fzf's --listen mode HTTP server arises from quadratic-time (O(n²)) body processing caused by repeat
Integer overflow in fzf's FuzzyMatchV2 function causes a non-recoverable process crash (denial of service) when input li
Exploit-DB