Executive brief
fzf, a popular command-line fuzzy finder tool, contains a flaw in its optional HTTP listening mode. An attacker can send a specially crafted request that causes the tool to consume excessive processor resources. This can lead to a denial-of-service condition, making the tool unresponsive and potentially impacting other operations on the system.
Technical details
fzf is vulnerable to an algorithmic complexity flaw (CWE-407) within its HTTP server implementation (src/server.go) when running in '--listen' mode. The 'handleHttpRequest' function performed repeated string concatenation ('body += text') for each token in an incoming request, leading to O(n²) time complexity due to constant re-allocation of backing arrays. An attacker can exploit this by sending a POST request containing many small segments, causing the single-threaded server to monopolize CPU resources and block all other clients. The issue was resolved in version 0.73.1 by migrating to 'strings.Builder' for amortized O(n) performance.
Affected products
- fzf fzf All versions before 0.73.1
Timeline
- 2026-06-30: advisory: Advisory published by CERT.PL and NVD
- 2026-06-30: patched: Fix committed to GitHub repository and released in version 0.73.1