ffuf is a fast web fuzzer written in Go. (CVE-2026-73232)
Description
ffuf versions prior to 2.2.0 contain a vulnerability where a malicious server can cause an out-of-memory denial of service. This occurs because the response size guard only checks the compressed Content-Length, while the code reads and decompresses response bodies without limiting the decompressed size. The issue is fixed in version 2.2.0.
CVSS v3.1
Score 7.5high
Affected software
pkg:deb/ubuntu/ffuf?arch=source&distro=jammypkg:deb/ubuntu/ffuf?arch=source&distro=esm-apps/noblepkg:deb/ubuntu/ffuf?arch=source&distro=stonkingpkg:deb/ubuntu/ffuf?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
ffuf is a fast web fuzzer written in Go. Versions before 2.2.0 have a vulnerability (CVE-2026-73232) where the response size guard in pkg/runner/simple.go only verifies the compressed Content-Length header. However, the code uses io.ReadAll to read response bodies that may be gzip, brotli, deflate, or chunked and transparently decompresses them without bounding the decompressed size. This allows a malicious target server to send a crafted response that causes an out-of-memory denial of service. The vulnerability is resolved in ffuf version 2.2.0.
Potential Impact
An attacker controlling a target server can cause ffuf clients running vulnerable versions to consume excessive memory and crash, resulting in a denial of service. There is no impact on confidentiality or integrity, only availability.
Mitigation Recommendations
Upgrade ffuf to version 2.2.0 or later where this issue is fixed. No other mitigations are indicated.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-73232
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:22.04:LTS","Ubuntu:Pro:24.04:LTS","Ubuntu:26.10","Ubuntu:26.04:LTS"]
- Cvss Version
- 3.1
Threat ID: 6ad3f58b2cdf04f6566621bb
Added to database: 10/17/2026, 22:24:11 UTC
Last enriched: 10/17/2026, 23:47:28 UTC
Last updated: 10/17/2026, 23:47:28 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.