Inefficient Algorithmic Complexity Vulnerability in fzf by junegunn
CVE-2026-115319

2LOW

Key Information:

Vendor

Junegunn

Status
Fzf
Vendor
CVE Published:
22 October 2026

What is CVE-2026-115319?

The fzf tool from junegunn is affected by a vulnerability in the maskActionContents function, which has inefficient algorithmic complexity. This flaw allows local attackers to perform a denial of service attack by sending large POST requests to the unauthenticated localhost port. Each request can block the single-threaded HTTP server, causing disruptions and service unavailability for approximately 30 seconds. This vulnerability affects multiple versions of fzf from 0.36.0 to 0.74.5, necessitating prompt updates to mitigate the risk.

Affected Version(s)

fzf 0.36.0 <= 0.74.5

References

https://github.com/junegunn/fzf/commit/b412a450538e5f4a1d...
patch
https://github.com/junegunn/fzf/blob/v0.74.5/src/options....
technical-description
https://github.com/junegunn/fzf
product

CVSS V4

Score:
2
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zachariah Mithani (AploSec)
.