CVE-2026-115319 (CVSS 2.5)

Description

fzf 0.36.0 through 0.74.5 contains an inefficient algorithmic complexity vulnerability in maskActionContents that allows local attackers to exhaust the --listen HTTP server through quadratic string concatenation. Attackers can repeatedly send POST bodies of about 1 MB to the unauthenticated localhost port, blocking the single-threaded server for about 30 seconds each time.

Is your site exposed to CVE-2026-115319?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

2.5

LOW

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

EPSS — Exploit Prediction

0.0010

Probability of exploitation

0.01%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-407 CWE-407

References

Other References

https://github.com/junegunn/fzf https://github.com/junegunn/fzf/blob/v0.74.5/src/options.go#L1680-L1736 https://github.com/junegunn/fzf/commit/b412a450538e5f4a1d7057732e75d945dafa18a6 https://www.vulncheck.com/advisories/fzf-0.36.0-through-0.74.5-denial-of-service-via-maskactioncontents

Frequently Asked Questions

What is CVE-2026-115319? +

fzf 0.36.0 through 0.74.5 contains an inefficient algorithmic complexity vulnerability in maskActionContents that allows local attackers to exhaust the --listen HTTP server through quadratic string concatenation. Attackers can repeatedly send POST bodies of about 1 MB to the unauthenticated localhost port, blocking the single-threaded server for about 30 seconds each time. It has a CVSS v3.1 base score of 2.5 (LOW).

How severe is CVE-2026-115319? +

CVE-2026-115319 has a CVSS v3.1 score of 2.5 out of 10, rated LOW. This is a low-severity vulnerability with limited impact. The EPSS score is 0.0010, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-115319? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-3276

unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating …

CVE-2026-40476

graphql-go is a Go implementation of GraphQL. In versions 15.31.4 and below, the OverlappingFieldsCanBeMerged validation rule performs O(n²) pairwise comparisons …

CVE-2026-43967

Inefficient Algorithmic Complexity vulnerability in absinthe-graphql absinthe allows unauthenticated denial of service via quadratic fragment-name uniqueness validation. 'Elixir.Absinthe.Phase.Document.Validation.UniqueFragmentNames':run/2 iterates over …

CVE-2026-112401

Pillow is a Python imaging library. From 5.4.0 until 13.0.0, Pillow performs quadratic copying while parsing GIF comments. GifImageFile._seek() repeatedly …

CVE-2026-58059

In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished names. This issue also affects Bouncy Castle …

CVE-2026-94658

Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to …

CVE-2026-115319