All vulnerabilities
CVE-2026-53433GHSA-mvmf-94v6-879gGO-2026-6620

github.com/junegunn/fzf: fzf vulnerable to denial of service through quadratic HTTP request-body accumulation

fzf github.com/junegunn/fzfgoLibraries & packages
Open in ThreatlineRecord JSON
CVSS
5.7Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.38%Chance of exploitation activity in the next 30 days, higher than 30% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0.73.1Fixed versionGitHub
Published30 Jun 2026Updated 1 Oct 2026CVE List

What fixes it

  • 0.73.1github.com/junegunn/fzf, goGitHubgo get github.com/junegunn/fzf@v0.73.1
  • 0.73.1fzfCVE List
  • 0.73.1github.com/junegunn/fzf, GoOSVgo get github.com/junegunn/fzf@v0.73.1

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

fzf is vulnerable to a Denial of Service (DoS) due to inefficient HTTP body processing in the --listen mode due to inefficient HTTP body processing using repeated string concatenation, resulting in quadratic time complexity (O(n²)). A crafted POST request with many small segments can trigger excessive CPU usage during request handling.This allows a single malicious request to monopolize the single‑threaded HTTP server, blocking all other clients and resulting in denial of service.

This issue was fixed in version 0.73.1.

Text from GitHub Advisory Database

Affected versions 3

  • github.com/junegunn/fzf, go< 0.73.1GitHub
  • fzfaffected: all versions before 0.73.1CVE List
  • github.com/junegunn/fzf, Gofrom first release, fixed in 0.73.1OSV

References 6