CVE-2026-53433

Katalog CVE

CVSS 7.5 · High EPSS 0,38%

Kerentanan Inefficient Algorithmic Complexity pada junegunn fzf. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

fzf is vulnerable to a Denial of Service (DoS) due to inefficient HTTP body processing in the --listen mode due to inefficient HTTP body processing using repeated string concatenation, resulting in quadratic time complexity (O(n²)). A crafted POST request with many small segments can trigger excessive CPU usage during request handling.This allows a single malicious request to monopolize the single‑threaded HTTP server, blocking all other clients and resulting in denial of service. This issue was fixed in version 0.73.1.

Rincian

Terbit di NVD

30 Juni 2026

Terakhir diubah

2 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-407: Inefficient Algorithmic Complexity

EPSS (30 hari)

0,38% peluang dieksploitasi; lebih tinggi dari 29,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/junegunn/fzf/commit/7963a2c6586c0b9eaa89b8995de8f0e08cf8a4ce patch
• https://cert.pl/en/posts/2026/06/CVE-2026-53432 advisory pihak ketiga
• https://github.com/junegunn/fzf product