CVE-2026-115319: Inefficient Algorithmic Complexity in junegunn fzf
Description
fzf versions 0.36.0 through 0.74.5 have an inefficient algorithmic complexity vulnerability in the maskActionContents function. This flaw allows local attackers to exhaust the --listen HTTP server by sending large POST requests, causing the single-threaded server to block for approximately 30 seconds per request. The vulnerability results from quadratic string concatenation, leading to resource exhaustion on the affected server.
CVSS v4.0
Score 2.0low
Affected software
junegunn
fzf
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in junegunn fzf (versions 0.36.0 through 0.74.5) is due to inefficient algorithmic complexity in the maskActionContents function. Local attackers can exploit this by sending repeated POST requests of about 1 MB to the unauthenticated localhost HTTP server running with the --listen option. Because the server is single-threaded, the quadratic string concatenation causes it to block for around 30 seconds per request, effectively exhausting the server's availability.
Potential Impact
Local attackers with access to the localhost interface can cause denial of service by exhausting the single-threaded HTTP server through repeated large POST requests. The impact is limited to local privilege and does not allow remote exploitation or code execution. The CVSS score of 2 indicates a low severity impact primarily due to the local attack vector and limited scope.
Mitigation Recommendations
No official patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should restrict access to the localhost HTTP server and avoid running the --listen server in untrusted environments to mitigate potential denial of service.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-22T10:11:36.987Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad9f0784d27ba8daa4bc4ac
Added to database: 10/22/2026, 11:16:08 UTC
Last enriched: 10/22/2026, 11:30:53 UTC
Last updated: 10/22/2026, 13:31:34 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.