Live › vulnerability › CVE-2026-115319
Go to dashboardfzf 0.36.0 through 0.74.5 builds a string quadratically in maskActionContents, so a POST body of about 1 MB blocks its single-threaded --listen HTTP server for roughly 30 seconds. An attacker on the same machine who can reach the unauthenticated localhost port can repeat the requests to keep the server unresponsive.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only fzf runs that start the --listen HTTP server are exposed, since that is the only path that accepts POST bodies. The attacker must be local, able to reach the localhost port. Teams that use fzf interactively without --listen can skip it.
No product ranges from the sources yet.
fzf --version and check whether it falls between 0.36.0 and 0.74.5--listen0.74.5, if the sources name one; otherwise unknown--listen until upgradedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
fzf 0.36.0 through 0.74.5 contains an inefficient algorithmic complexity vulnerability in maskActionContents that allows local attackers to exhaust the --listen HTTP server through quadratic string concatenation. Attackers can repeatedly send POST bodies of about 1 MB to the unauthenticated localhost port, blocking the single-threaded server for about 30 seconds each time.
This page as .md · .json · in your agent: get_signal("CVE-2026-115319")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.