{"id":"CVE-2026-115319","kind":"vulnerability","aliases":["CVE-2026-115319"],"related":[],"title":"fzf: quadratic string concatenation lets local requests stall its listen server","description":"fzf 0.36.0 through 0.74.5 contains an inefficient algorithmic complexity vulnerability in maskActionContents that allows local attackers to exhaust the --listen HTTP server through quadratic string concatenation. Attackers can repeatedly send POST bodies of about 1 MB to the unauthenticated localhost port, blocking the single-threaded server for about 30 seconds each time.","summary":"fzf 0.36.0 through 0.74.5 builds a string quadratically in maskActionContents, so a POST body of about 1 MB blocks its single-threaded --listen HTTP server for roughly 30 seconds. An attacker on the same machine who can reach the unauthenticated localhost port can repeat the requests to keep the server unresponsive.","severity":"low","cvss":2.5,"epss":0.00101,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["developer-tools","fzf","package","shell"],"not_affected_if":["default-config","no-listen-flag"],"how_to_check":"- Run `fzf --version` and check whether it falls between `0.36.0` and `0.74.5`\n- Check whether any script or process starts fzf with `--listen`","fix":"- Upgrade fzf to a version later than `0.74.5`, if the sources name one; otherwise unknown\n- Stop using `--listen` until upgraded","status":"open","published_at":"2026-10-22T11:17:50+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:49:30+00:00","updated_at":"2026-10-25T04:49:30+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:49:30Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade fzf to a version later than `0.74.5`, if the sources name one; otherwise unknown\n- Stop using `--listen` until upgraded","reach":"local","title":"fzf: quadratic string concatenation lets local requests stall its listen server","impact":"low","summary":"fzf 0.36.0 through 0.74.5 builds a string quadratically in maskActionContents, so a POST body of about 1 MB blocks its single-threaded --listen HTTP server for roughly 30 seconds. An attacker on the same machine who can reach the unauthenticated localhost port can repeat the requests to keep the server unresponsive.","category":"package","nicknames":[],"who_cares":["fzf","developer-tools","shell"],"confidence":0.7,"needs_auth":"no","worst_case":"Local attacker stalls the fzf listen server for about 30 seconds per request","analyst_note":"","how_to_check":"- Run `fzf --version` and check whether it falls between `0.36.0` and `0.74.5`\n- Check whether any script or process starts fzf with `--listen`","needs_analyst":false,"not_affected_if":["default-config","no-listen-flag"],"who_is_affected":"Only fzf runs that start the --listen HTTP server are exposed, since that is the only path that accepts POST bodies. The attacker must be local, able to reach the localhost port. Teams that use fzf interactively without --listen can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000605,"input_tokens":3400,"output_tokens":529,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-115319':14A,17A '-2026':13A,16A '0.36.0':25B,77C '0.74.5':27B,79C '1':40B,110C '30':52B,125C 'algorithm':83C 'allow':89C 'attack':55B,91C,102C 'block':42B,117C 'bodi':37B,107C 'build':28B 'complex':84C 'concaten':4A,101C 'contain':80C 'cve':12A,15A 'develop':19B 'developer-tool':18B 'exhaust':93C 'fzf':1A,21B,24B,76C 'http':48B,96C 'ineffici':82C 'keep':72B 'let':5A 'listen':10A,47B,95C 'local':6A,90C 'localhost':65B,115C 'machin':59B 'maskactioncont':33B,87C 'mb':41B,111C 'packag':22B 'port':66B,116C 'post':36B,106C 'quadrat':2A,31B,99C 'reach':62B 'repeat':68B,104C 'request':7A,70B 'rough':51B 'second':53B,126C 'send':105C 'server':11A,49B,74B,97C,122C 'shell':23B 'singl':45B,120C 'single-thread':44B,119C 'stall':8A 'string':3A,30B,100C 'thread':46B,121C 'time':128C 'tool':20B 'unauthent':64B,114C 'unrespons':75B 'vulner':85C","nicknames":[],"mitigations":[],"who_affected":"Only fzf runs that start the --listen HTTP server are exposed, since that is the only path that accepts POST bodies. The attacker must be local, able to reach the localhost port. Teams that use fzf interactively without --listen can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T11:17:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115319","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115319","severity":null,"published_at":"2026-10-22T11:17:50+00:00","modified_at":"2026-10-22T17:40:46+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115319","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115319","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}