CVE-2026-53433 Denial of Service in fzf
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-53433?
CVE-2026-53433 is a medium-severity vulnerability in fzf, published on 30 Jun 2026.
Official description
fzf is vulnerable to a Denial of Service (DoS) due to inefficient HTTP body processing in the --listen mode due to inefficient HTTP body processing using repeated string concatenation, resulting in quadratic time complexity (O(n²)). A crafted POST request with many small segments can trigger excessive CPU usage during request handling.This allows a single malicious request to monopolize the single‑threaded HTTP server, blocking all other clients and resulting in denial of service.
This issue was fixed in version 0.73.1.
Weakness: CWE-407
Which versions are affected by CVE-2026-53433?
3 open source packages ship an affected version, including github.com/junegunn/fzf. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/junegunn/fzf Go | All versions | 0.73.1 |
github.com/junegunn/fzf Go | All versions | 0.73.1 |
github.com/junegunn/fzf Go | All versions | 0.73.1 |
Products include Junegunn Fzf.
How do I fix CVE-2026-53433?
Upgrade github.com/junegunn/fzf to 0.73.1 or later.
Is CVE-2026-53433 being exploited?
There is no known exploitation of CVE-2026-53433 in the wild and no public exploit code.
Other vulnerabilities in fzf
Sources
Also known as DEBIAN-CVE-2026-53433, GHSA-mvmf-94v6-879g, GO-2026-6620, UBUNTU-CVE-2026-53433.