EUVD-2026-56926Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack transits the network to ffuf with no privileges or complexity; impact is availability-only on the vulnerable process, no confidentiality or integrity effect.
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
4DescriptionCVE.org
ffuf is a fast web fuzzer written in Go. Prior to 2.2.0, ffuf allows a malicious target server to cause an out-of-memory denial of service because the response size guard in pkg/runner/simple.go checks only the compressed Content-Length while io.ReadAll reads gzip, brotli, deflate, transparently decompressed, or chunked response bodies without a decompressed-size bound. This issue is fixed in version 2.2.0.
AnalysisAI
Out-of-memory denial-of-service in ffuf prior to v2.2.0 allows a malicious HTTP server to crash the fuzzer by returning a decompression bomb - a tiny compressed payload that expands to gigabytes - because the response-size guard in pkg/runner/simple.go checked only the compressed Content-Length while io.ReadAll consumed the fully decompressed stream without any byte cap. Any ffuf user fuzzing a hostile endpoint is affected; no special configuration is required. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | ffuf must be executing an active fuzzing run against an HTTP server controlled or compromised by the attacker. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) score accurately reflects the low-complexity, unauthenticated network path, but the real-world threat model is narrower than a typical server-side AV:N vulnerability: ffuf is a client-side tool, so exploitation requires a user to actively fuzz a server controlled by the attacker - the attacker cannot push this attack to arbitrary internet hosts. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker operates a web server configured to return a Content-Encoding: gzip response with a small compressed payload (a few kilobytes of compressed zeros) but a decompressed expansion of several gigabytes. When a penetration tester runs ffuf against this server, ffuf's transport either transparently decodes the gzip stream (stripping size headers) or passes it through the manual brotli/deflate decoder path - in both cases, io.ReadAll consumes the expanding stream until the process is killed by the OS OOM killer. … |
| Remediation | Upgrade ffuf to version 2.2.0 or later, available at https://github.com/ffuf/ffuf/releases/tag/v2.2.0; this is the only confirmed fix per the GitHub security advisory GHSA-jcvh-xf52-2cwm. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all systems where ffuf is deployed to identify current versions in use. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today