CVE-2026-115319
Description
A flaw was found in fzf. Inefficient string concatenation in the maskActionContents function allows a local attacker to cause a Denial of Service (DoS). By repeatedly sending large HTTP requests to the local server, an attacker can block the single-threaded process and exhaust processing resources, rendering the service unresponsive.
Statement
Red Hat rates the impact of this flaw as Low because exploitation requires a local attacker and fzf to be running with the non-default --listen option, which exposes an unauthenticated server on localhost. Even then, the impact is limited to temporarily blocking the single-threaded fzf process; there is no impact on confidentiality or integrity. All shipped versions of fzf (Fedora, EPEL 9, and the copy vendored as a Go dependency in ocm-container) are within the affected range 0.36.0 through 0.74.5. The upstream fix is commit b412a450, which is not yet part of a released fzf version.
Mitigation
Do not run fzf with the --listen option. The vulnerable code path is only reachable through the local HTTP server it starts. Without --listen, fzf does not accept the POST requests that trigger the quadratic string concatenation.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
