CVE-2026-53432

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-53432
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53432.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-53432
Downstream
Published
2026-06-30T12:01:07.027Z
Modified
2026-07-08T08:13:42.839362905Z
Severity
  • 5.6 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Integer Overflow in fzf
Details

fzf is vulnerable to Integer Overflow leading to crash in FuzzyMatchV2 function. When input line length is approximately 2,200,000 bytes and pattern length is 999 bytes, the product overflows. The Go runtime detects the invalid slice bounds and terminates the process immediately with a non-recoverable panic.

This issue was fixed in version 0.73.1.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53432.json",
    "cna_assigner": "CERT-PL",
    "cwe_ids": [
        "CWE-190"
    ]
}
References

Affected packages

Git / github.com/junegunn/fzf

Affected ranges

Type
GIT
Repo
https://github.com/junegunn/fzf
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ce4bef75954bebd87e0886435bcf8c6904328ab0
Fixed
ccedd064ca56921a4235219516b3d834f60e7b91
Database specific 
{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.73.1"
        }
    ],
    "cpe": "cpe:2.3:a:junegunn:fzf:*:*:*:*:*:*:*:*"
}

Affected versions

0.*
0.1.0
0.10.0
0.10.1
0.10.2
0.10.3
0.10.4
0.10.5
0.10.6
0.10.7
0.10.8
0.10.9
0.11.0
0.11.1
0.11.2
0.11.3
0.11.4
0.12.0
0.12.1
0.12.2
0.13.0
0.13.1
0.13.2
0.13.3
0.13.4
0.13.5
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
0.15.8
0.15.9
0.16.0
0.16.1
0.16.10
0.16.11
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.16.7
0.16.8
0.16.9
0.17.0
0.17.0-2
0.17.1
0.17.3
0.17.4
0.17.5
0.18.0
0.19.0
0.20.0
0.21.0
0.21.0-1
0.21.1
0.22.0
0.23.0
0.23.1
0.24.0
0.24.0-1
0.24.1
0.24.2
0.24.3
0.24.4
0.25.0
0.25.1
0.26.0
0.27.0
0.27.1
0.27.2
0.27.3
0.28.0
0.29.0
0.3.1
0.30.0
0.32.0
0.32.1
0.33.0
0.34.0
0.35.0
0.35.1
0.36.0
0.37.0
0.38.0
0.39.0
0.4.0
0.4.2
0.40.0
0.41.0
0.41.1
0.42.0
0.43.0
0.44.0
0.44.1
0.45.0
0.46.0
0.46.1
0.47.0
0.48.0
0.48.1
0.49.0
0.5.0
0.5.1
0.50.0
0.51.0
0.52.0
0.52.1
0.53.0
0.6.0
0.7.0
0.7.1
0.8.0
0.8.1
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
0.9.0
0.9.1
0.9.10
0.9.11
0.9.12
0.9.13
0.9.2
0.9.3
0.9.4
0.9.4-1
0.9.7
0.9.7-1
v0.*
v0.54.0
v0.54.1
v0.54.2
v0.54.3
v0.55.0
v0.56.0
v0.56.1
v0.56.2
v0.56.3
v0.57.0
v0.58.0
v0.59.0
v0.60.0
v0.60.1
v0.60.2
v0.60.3
v0.61.0
v0.61.1
v0.61.2
v0.61.3
v0.62.0
v0.63.0
v0.64.0
v0.65.0
v0.65.1
v0.65.2
v0.66.0
v0.66.1
v0.67.0
v0.68.0
v0.70.0
v0.71.0
v0.72.0
v0.73.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53432.json"