Skip to content

Vendor

fzf vulnerabilities

2 published CVES affecting fzf, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
0
High
0
Medium
2
Low
0
Unscored
0
CISA KEV
0
Atom feed of fzf alerts

Products

Latest fzf CVEs

Newest publication first

  1. CVE-2026-53433 Denial of Service in fzf

    Published
    MediumCVSS 5.7 EPSS 0.38%

    fzf is vulnerable to a Denial of Service (DoS) due to inefficient HTTP body processing in the --listen mode due to inefficient HTTP body processing using repeated string concatenation, resulting in quadratic time complexity (O(n²)). A crafted POST request with many small segments...

  2. CVE-2026-53432 Integer Overflow in fzf

    Published
    MediumCVSS 5.6 EPSS 0.42%

    fzf is vulnerable to Integer Overflow leading to crash in FuzzyMatchV2 function. When input line length is approximately 2,200,000 bytes and pattern length is 999 bytes, the product overflows. The Go runtime detects the invalid slice bounds and terminates the process immediately...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.