Live › vulnerability › CVE-2026-53433
Go to dashboardfzf's --listen mode parses HTTP POST bodies by repeated string concatenation, which costs quadratic CPU time in the body size. A crafted POST made of many small segments makes one request consume excessive CPU and monopolize the single-threaded server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| github.com/junegunn/fzf | go | < 0.73.1 | 0.73.1 |
Run fzf --version and check whether it is below 0.73.1.
Search scripts, shell config and FZF_DEFAULT_OPTS for --listen.
If --listen is not used, the server is not running.
0.73.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
fzf is vulnerable to a Denial of Service (DoS) due to inefficient HTTP body processing in the --listen mode due to inefficient HTTP body processing using repeated string concatenation, resulting in quadratic time complexity (O(n²)). A crafted POST request with many small segments can trigger excessive CPU usage during request handling.This allows a single malicious request to monopolize the single‑threaded HTTP server, blocking all other clients and resulting in denial of service.
This issue was fixed in version 0.73.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-53433")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.