CVE-2026-115319 junegunn CVE debrief

Who should care

Users of fzf versions 0.36.0 through 0.74.5 should assess exposure and prioritize patching to prevent potential attacks. This vulnerability can cause denial-of-service conditions, and the server can be blocked for about 30 seconds per attack. Local attackers can exhaust the --listen HTTP server through quadratic string concatenation.

Why it matters

CVE-2026-115319 is a denial-of-service vulnerability affecting fzf versions 0.36.0 through 0.74.5. Users should assess exposure and prioritize patching.

• Local attackers can cause denial-of-service conditions
• Server can be blocked for about 30 seconds per attack

Technical summary

The vulnerability is due to inefficient algorithmic complexity in maskActionContents, allowing local attackers to exhaust the --listen HTTP server through quadratic string concatenation. This can cause denial-of-service conditions, and the server can be blocked for about 30 seconds per attack. A patch commit is available for the vulnerability. Users of fzf versions 0.36.0 through 0.74.5 should assess exposure and prioritize patching to prevent potential attacks. The vulnerability has a CVSS score of 2 and a CVSS severity of LOW.

Defensive priority

Assess exposure and prioritize patching for fzf versions 0.36.0 through 0.74.5.

Recommended defensive actions

• Assess exposure and prioritize patching for fzf versions 0.36.0 through 0.74.5
• Review and apply the patch commit
• Verify the vulnerability and assess potential impact
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description and affected versions. The vulnerability affects fzf versions 0.36.0 through 0.74.5. Local attackers can cause denial-of-service conditions. The server can be blocked for about 30 seconds per attack. There is a patch commit available for the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.