By vendor

Junegunn vulnerabilities

Known CVEs affecting Junegunn products, prioritized by severity, with SEC.co remediation and detection guidance.

2 published vulnerabilities

• CVE-2026-53432HIGH 7.5

  fzf, a popular command-line fuzzy finder tool, contains an integer overflow vulnerability in its FuzzyMatchV2 matching function. When processing extremely large input—around 2.2 million bytes—combined with a moderately long search pattern of 999 bytes, an arithmetic operation overflows and causes the application to crash immediately. This is a denial-of-service issue: attackers cannot steal data or gain unauthorized access, but they can reliably crash any system running vulnerable fzf versions. The vulnerability affects deployments where fzf processes untrusted or user-supplied input at scale.

• CVE-2026-53433HIGH 7.5

  fzf, a popular command-line fuzzy finder tool, contains a denial of service vulnerability in its --listen mode HTTP server. When a malicious actor sends a specially crafted HTTP POST request with many small segments, the server's request processing becomes extremely slow due to inefficient string concatenation. Because fzf's HTTP server is single-threaded, this attack can freeze the entire service, preventing legitimate users from accessing it. The vulnerability affects fzf versions prior to 0.73.1 and requires only network access to exploit—no authentication or user interaction is needed.