CVE-2026-115319
- Source
- https://cve.org/CVERecord?id=CVE-2026-115319
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-115319.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-115319
- Published
- 2026-10-22T10:57:40Z
- Modified
- 2026-10-23T02:45:49Z
- Severity
-
- 2.0 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- fzf 0.36.0 through 0.74.5 Denial of Service via maskActionContents
- Details
-
fzf 0.36.0 through 0.74.5 contains an inefficient algorithmic complexity vulnerability in maskActionContents that allows local attackers to exhaust the --listen HTTP server through quadratic string concatenation. Attackers can repeatedly send POST bodies of about 1 MB to the unauthenticated localhost port, blocking the single-threaded server for about 30 seconds each time.
- Database specific
{ "cna_assigner": "VulnCheck", "cwe_ids": [ "CWE-407" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115319.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115319.json
- https://github.com/junegunn/fzf
- https://github.com/junegunn/fzf/blob/v0.74.5/src/options.go#L1680-L1736
- https://github.com/junegunn/fzf/commit/b412a450538e5f4a1d7057732e75d945dafa18a6
- https://nvd.nist.gov/vuln/detail/CVE-2026-115319
- https://www.vulncheck.com/advisories/fzf-0.36.0-through-0.74.5-denial-of-service-via-maskactioncontents
Affected packages
Git / github.com/junegunn/fzf
Affected ranges
- Type
- GIT
- Repo
- https://github.com/junegunn/fzf
- Events
-
IntroducedLast AffectedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "0.36.0" }, { "last_affected": "0.74.5" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" }, { "range": [ { "fixed": "b412a450538e5f4a1d7057732e75d945dafa18a6" } ], "source": "REFERENCES_COMMIT" } ] }
Affected versions
0.*
0.36.0
0.37.0
0.38.0
0.39.0
0.40.0
0.41.0
0.41.1
0.42.0
0.43.0
0.44.0
0.44.1
0.45.0
0.46.0
0.46.1
0.47.0
0.48.0
0.48.1
0.49.0
0.50.0
0.51.0
0.52.0
0.52.1
0.53.0
v0.*
v0.54.0
v0.54.1
v0.54.2
v0.54.3
v0.55.0
v0.56.0
v0.56.1
v0.56.2
v0.56.3
v0.57.0
v0.58.0
v0.59.0
v0.60.0
v0.60.1
v0.60.2
v0.60.3
v0.61.0
v0.61.1
v0.61.2
v0.61.3
v0.62.0
v0.63.0
v0.64.0
v0.65.0
v0.65.1
v0.65.2
v0.66.0
v0.66.1
v0.67.0
v0.68.0
v0.70.0
v0.71.0
v0.72.0
v0.73.0
v0.73.1
v0.74.0
v0.74.1
v0.74.2
v0.74.3
v0.74.4
v0.74.5