CVE-2026-53433
Description
A flaw was found in fzf, a command-line fuzzy finder. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by sending a crafted POST request with many small segments to the --listen mode. The inefficient HTTP body processing, which uses repeated string concatenation, leads to quadratic time complexity, causing excessive CPU usage and blocking other clients.
Statement
A flaw was found in fzf, a command-line fuzzy finder. When fzf is running in --listen mode (a non-default, opt-in feature), inefficient HTTP body processing using repeated string concatenation results in quadratic time complexity. A crafted POST request can monopolize the single-threaded HTTP server, causing denial of service. Red Hat has corrected the impact from IMPORTANT to MODERATE — the original AI-Bot CVSS of 7.5 (AV:N/AC:L) did not account for the --listen mode being a non-default feature that must be explicitly enabled. The CVEORG CVSSv4 score of 5.7 (AV:L/AT:P) more accurately reflects the prerequisite nature of the attack.
Mitigation
Do not use fzf's --listen mode in untrusted network environments. If --listen is required, restrict network access to the fzf listener port using firewall rules.
Understanding the Weakness (CWE)
Other
Technical Impact: Reduce Performance
This issue can make the product perform more slowly. If the relevant code is reachable by an attacker, then this could be influenced to create performance problem.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
