CVE-2026-115319

2.5 LOWpublic exploit available

Published 2026-10-22 · Updated 2026-10-22

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

fzf 0.36.0 through 0.74.5 contains an inefficient algorithmic complexity vulnerability in maskActionContents that allows local attackers to exhaust the --listen HTTP server through quadratic string concatenation. Attackers can repeatedly send POST bodies of about 1 MB to the unauthenticated localhost port, blocking the single-threaded server for about 30 seconds each time.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

Weaknesses

CWE-407

Public exploit & PoC references

https://github.com/junegunn/fzf
https://github.com/junegunn/fzf/blob/v0.74.5/src/options.go#L1680-L1736
https://github.com/junegunn/fzf/commit/b412a450538e5f4a1d7057732e75d945dafa18a6

All references

https://github.com/junegunn/fzf
https://github.com/junegunn/fzf/blob/v0.74.5/src/options.go#L1680-L1736
https://github.com/junegunn/fzf/commit/b412a450538e5f4a1d7057732e75d945dafa18a6
https://www.vulncheck.com/advisories/fzf-0.36.0-through-0.74.5-denial-of-service-via-maskactioncontents

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2026-100700PoC
HIGHCVE-2026-101021PoC
MEDIUMCVE-2026-102277PoC
MEDIUMCVE-2026-102461PoC
HIGHCVE-2026-102994PoC
HIGHCVE-2026-102997PoC
HIGHCVE-2026-102999PoC
UNSCOREDCVE-2026-103604PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.