{"id":"CVE-2026-115319","summary":"fzf 0.36.0 through 0.74.5 Denial of Service via maskActionContents","details":"fzf 0.36.0 through 0.74.5 contains an inefficient algorithmic complexity vulnerability in maskActionContents that allows local attackers to exhaust the --listen HTTP server through quadratic string concatenation. Attackers can repeatedly send POST bodies of about 1 MB to the unauthenticated localhost port, blocking the single-threaded server for about 30 seconds each time.","modified":"2026-10-23T02:45:49.397912159Z","published":"2026-10-22T10:57:40.288Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-407"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115319.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115319.json"},{"type":"PACKAGE","url":"https://github.com/junegunn/fzf"},{"type":"ARTICLE","url":"https://github.com/junegunn/fzf/blob/v0.74.5/src/options.go#L1680-L1736"},{"type":"FIX","url":"https://github.com/junegunn/fzf/commit/b412a450538e5f4a1d7057732e75d945dafa18a6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115319"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/fzf-0.36.0-through-0.74.5-denial-of-service-via-maskactioncontents"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/junegunn/fzf","events":[{"introduced":"20230117636c9dfa3ed6f6428c5bc4c51b02f60a"},{"last_affected":"c0a193e031f01fb50bf6f7be4381990a3753f7cf"},{"fixed":"b412a450538e5f4a1d7057732e75d945dafa18a6"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0.36.0"},{"last_affected":"0.74.5"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"b412a450538e5f4a1d7057732e75d945dafa18a6"}]}]}}],"versions":["v0.74.5","v0.74.4","v0.74.3","v0.74.2","v0.74.1","v0.74.0","v0.73.1","v0.73.0","v0.72.0","v0.71.0","v0.70.0","v0.68.0","v0.67.0","v0.66.1","v0.66.0","v0.65.2","v0.65.1","v0.65.0","v0.64.0","v0.63.0","v0.62.0","v0.61.3","v0.61.2","v0.61.1","v0.61.0","v0.60.3","v0.60.2","v0.60.1","v0.60.0","v0.59.0","v0.58.0","v0.57.0","v0.56.3","v0.56.2","v0.56.1","v0.56.0","v0.55.0","v0.54.3","v0.54.2","v0.54.1","v0.54.0","0.53.0","0.52.1","0.52.0","0.51.0","0.50.0","0.49.0","0.48.1","0.48.0","0.47.0","0.46.1","0.46.0","0.45.0","0.44.1","0.44.0","0.43.0","0.42.0","0.41.1","0.41.0","0.40.0","0.39.0","0.38.0","0.37.0","0.36.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-115319.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}]}