Threat database

fzf versions 0.36.0 through 0.74.5 have an inefficient algorithmic complexity vulnerability in the maskActionContents function. This flaw allows local attackers to exhaust the --listen HTTP server by sending large POST requests, causing the single-threaded server to block for approximately 30 seconds per request. The vulnerability results from quadratic string concatenation, leading to resource exhaustion on the affected server.