CVE-2026-53433: fzf --listen Denial of Service via HTTP Body Processing

Technical summary

The vulnerability stems from quadratic time complexity (O(n²)) in HTTP body processing when fzf is running in --listen mode. The root cause is repeated string concatenation during request body accumulation, a well-known algorithmic antipattern that degrades performance dramatically as input size grows. An attacker crafting a POST request with many small segments forces the server to perform excessive concatenation operations, consuming CPU resources and blocking the single-threaded event loop. This prevents the server from accepting or processing new connections, resulting in complete service unavailability. The issue is classified as CWE-407 (Inefficient Algorithmic Complexity).

Business impact

Organizations using fzf in --listen mode as part of an automated workflow, integration platform, or service-exposed application face significant availability risk. A single unauthenticated network request can disable the service without leaving complex exploitation trails. This is particularly concerning for teams that rely on fzf for CI/CD pipelines, interactive development environments accessed remotely, or containerized deployments where the service must remain responsive. Recovery requires restarting the affected process, potentially disrupting dependent workflows.

Affected systems

junegunn fzf versions prior to 0.73.1 are affected when running with the --listen flag enabled. The vulnerability does not affect the standard interactive fuzzy-finder use case; it is specific to the HTTP server mode. Deployments using fzf in scripts, shells, or terminal mode without --listen are not impacted.

Exploitability

Exploitability is straightforward. The attack requires only network connectivity to the fzf --listen HTTP server (typically localhost or a service port) and does not require authentication, credentials, or user interaction. An attacker can trigger the vulnerability with a basic HTTP POST request containing segmented data, making it trivial to weaponize. The single-threaded architecture of the server amplifies the impact: one malicious request completely denies service to all other clients.

Remediation

Upgrade fzf to version 0.73.1 or later, which resolves the inefficient string concatenation in HTTP body processing. For environments where immediate patching is not feasible, restrict network access to the fzf --listen port using firewall rules or network segmentation, limiting exposure to trusted clients only. If --listen mode is not required, disable it entirely.

Patch guidance

Verify that your fzf installation is running version 0.73.1 or later. Check the current version by running 'fzf --version'. Upgrade via your package manager (e.g., 'brew upgrade fzf' on macOS, 'apt upgrade fzf' on Debian/Ubuntu) or rebuild from the junegunn/fzf GitHub repository at the 0.73.1 tag or newer. Test the patched version in a non-production environment first to confirm compatibility with existing integrations or scripts.

Detection guidance

Monitor fzf processes running with the --listen flag and examine their command-line arguments during regular configuration audits. If --listen is enabled, implement network-level monitoring for the corresponding HTTP port to detect unusual request patterns (e.g., POST requests with abnormally large or many-segmented bodies from unexpected sources). Log HTTP server errors and CPU spikes correlated with specific incoming requests. In container or cloud environments, set resource limits (CPU, memory) on fzf processes to mitigate the impact of such attacks.

Why prioritize this

This vulnerability warrants medium-to-high priority for organizations using fzf in --listen mode. The HIGH CVSS score (7.5) reflects the ease of exploitation and complete availability impact, though the scope is limited to environments explicitly running --listen. Organizations not using this feature can deprioritize. Those with fzf exposed to network access should patch immediately; those with it restricted to localhost or isolated networks can follow a standard patching cadence but should not delay significantly.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible vulnerability with no authentication barrier (AV:N, PR:N) and low attack complexity (AC:L). The impact is a complete denial of service with no data confidentiality or integrity loss (C:N, I:N, A:H). The score assumes the default scenario where --listen is exposed; environments with restrictive network policies would have lower practical risk.

Frequently asked questions