CVE-2026-53433— fzf 资源管理错误漏洞

Denial of Service in fzf

fzf is vulnerable to a Denial of Service (DoS) due to inefficient HTTP body processing in the --listen mode due to inefficient HTTP body processing using repeated string concatenation, resulting in quadratic time complexity (O(n²)). A crafted POST request with many small segments can trigger excessive CPU usage during request handling.This allows a single malicious request to monopolize the single‑threaded HTTP server, blocking all other clients and resulting in denial of service. This issue was fixed in version 0.73.1.

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

算法复杂性

fzf 资源管理错误漏洞

fzf fzf是fzf个人开发者的一款通用命令行模糊搜索工具。 fzf 0.73.1之前版本存在资源管理错误漏洞，该漏洞源于--listen模式下HTTP body处理效率低下，使用重复字符串拼接导致二次时间复杂度（O(n²)），可能导致精心构造的POST请求触发处理期间CPU过度使用，使单一恶意请求独占单线程HTTP服务器，阻止其他所有客户端，从而造成拒绝服务。

N/A

N/A