CVE-2026-115319 in fzf
Summary
by MITRE • 10/23/2026
fzf 0.36.0 through 0.74.5 contains an inefficient algorithmic complexity vulnerability in maskActionContents that allows local attackers to exhaust the --listen HTTP server through quadratic string concatenation. Attackers can repeatedly send POST bodies of about 1 MB to the unauthenticated localhost port, blocking the single-threaded server for about 30 seconds each time.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in fzf versions ranging from 0.36.0 through 0.74.5 represents a classic algorithmic complexity issue that undermines the availability of the application when operating in listen mode. This flaw is specifically located within the maskActionContents function, which processes input data for actions triggered via the HTTP interface. The core technical deficiency lies in the implementation of string concatenation operations where new content is appended to existing strings using an inefficient method. In many programming languages and standard libraries, appending to a string without pre-allocating sufficient buffer space or utilizing efficient data structures like builders results in quadratic time complexity relative to the size of the input. This means that as the volume of incoming data increases, the processing time does not grow linearly but rather exponentially, creating a significant performance bottleneck.
When fzf is configured with the --listen flag, it exposes an HTTP server on localhost designed to accept commands and interact with external tools or scripts. By default, this server operates in a single-threaded manner, meaning it processes one request at a time sequentially. An attacker who has local access to the machine can exploit this architectural limitation by sending repeated POST requests containing approximately 1 MB of data to the unauthenticated endpoint associated with maskActionContents. Because the vulnerability is triggered during the processing of these POST bodies, each malicious request forces the server to perform an excessive number of memory allocation and copy operations. The result is that the single-threaded event loop becomes blocked for roughly thirty seconds per attack vector, effectively rendering the service unavailable for any other legitimate users or processes attempting to communicate with fzf via its HTTP interface.
From a security impact perspective, this vulnerability constitutes a denial-of-service condition against local services. It aligns with CWE-400, which describes Uncontrolled Resource Consumption, specifically highlighting how inefficient algorithms can lead to resource exhaustion such as CPU cycles and memory bandwidth. Furthermore, in the context of the MITRE ATT&CK framework, this behavior maps to T1499 Endpoint Denial of Service, where an adversary disrupts or denies service to specific components on a system by exploiting software vulnerabilities rather than overwhelming network bandwidth with volumetric traffic. The attack is particularly insidious because it does not require authentication, relying solely on the default configuration that exposes local ports for inter-process communication and automation purposes.
Mitigation strategies must address both the immediate code flaw and broader operational security practices regarding exposed services. Developers should refactor the maskActionContents function to utilize efficient string handling mechanisms, such as StringBuilder in Java or similar append-optimized structures in Go and Python, ensuring that memory operations scale linearly with input size rather than quadratically. For system administrators and users currently running vulnerable versions of fzf, it is critical to restrict access to the --listen port using firewall rules or localhost binding configurations if external network exposure is not strictly necessary. Additionally, implementing rate limiting on the HTTP server can help mitigate the impact of repeated malicious requests by throttling connections from a single source IP address. Upgrading to a patched version that resolves this algorithmic inefficiency remains the most effective long-term solution to restore service reliability and prevent local denial-of-service attacks via the fzf HTTP interface.