CVE-2026-73232 ffuf CVE debrief

Who should care

Defenders responsible for web application security, particularly those using the ffuf tool, should be aware of this vulnerability and take steps to mitigate it. This includes reviewing and updating affected systems, monitoring for potential denial-of-service attacks, and verifying affected scope and severity. Security teams and vulnerability management teams should also be aware of this vulnerability and prioritize upgrading to version 2.2.0 or later.

Why it matters

CVE-2026-73232 is a high-severity vulnerability in the ffuf fast web fuzzer tool that can lead to denial-of-service attacks. Defenders should prioritize upgrading to version 2.2.0 or later to prevent potential attacks.

• Potential denial-of-service attacks against web applications using ffuf
• Need to verify and upgrade to version 2.2.0 or later
• Possible impact on web application availability and performance

Technical summary

The ffuf fast web fuzzer tool is vulnerable to a denial-of-service attack due to an out-of-memory issue. The response size guard in pkg/runner/simple.go only checks the compressed Content-Length, while io.ReadAll reads gzip, brotli, deflate, transparently decompressed, or chunked response bodies without a decompressed-size bound. This allows a malicious target server to cause an out-of-memory denial of service. The issue is fixed in version 2.2.0 by adding a decompressed-size bound check. Defenders should prioritize upgrading to version 2.2.0 or later to prevent potential denial-of-service attacks.

Defensive priority

Defenders should prioritize upgrading to version 2.2.0 or later to prevent potential denial-of-service attacks.

Recommended defensive actions

• Upgrade to version 2.2.0 or later
• Review and update affected systems
• Monitor for potential denial-of-service attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and references to source code changes and advisories. The vulnerability was reported by a researcher and fixed by the ffuf development team. The fix is included in version 2.2.0, which is recommended for all users of the ffuf tool. Defenders should verify affected scope and severity, review official advisories, and plan vendor-supported updates or mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.