Executive brief
ffuf is a popular web fuzzing tool used for security testing and content discovery. A malicious web server can crash ffuf by sending specially crafted compressed HTTP responses that expand to gigabytes in memory, causing the fuzzing process to be killed and losing all accumulated scan results. Because the crash repeats on every subsequent attempt against that server, an attacker can effectively make their target immune to ffuf-based scanning.
Technical details
This vulnerability is a decompression bomb (CWE-409) in ffuf's response body handling code (pkg/runner/simple.go). The vulnerable code checks only the server-supplied Content-Length header, which reflects the compressed size, then reads the decompressed stream unbounded using io.ReadAll. The check is bypassed in three ways: (1) gzip transparently decompresses at transport level, stripping Content-Encoding and Content-Length headers; (2) for brotli/deflate, Content-Length reflects small compressed size and passes the check, but manual decompression is unbounded; (3) chunked transfer encoding lacks Content-Length entirely, causing the numeric parse to fail. An attacker-controlled endpoint can trigger this on any default invocation (e.g., `ffuf -u http://target/FUZZ -w wordlist.txt`) with no authentication or user interaction required. Impact is availability only; no data confidentiality or integrity is affected. Fixed in ffuf 2.2.0 via bounded io.LimitReader enforcing the existing 5 MB download cap regardless of encoding or chunking.
Affected products
- ffuf ffuf <= 1.5.0
- ffuf ffuf/v2 <= 2.1.0
Timeline
- 2026-07-11: disclosed: Published to GitHub Advisory Database
- 2026-09-03: patched: ffuf 2.2.0 released with fix via io.LimitReader enforcement