What is CVE-2026-115319?

CVE-2026-115319 is a low-severity vulnerability in Junegunn Fzf, classified under Inefficient Algorithmic Complexity. CVSS score: 2.5/10. Published 2026-10-22.

How severe is CVE-2026-115319?

Low severity. CVSS v3 base score is 2.5 out of 10.

Vulnerability in Junegunn Fzf

CVE-2026-115319

fzf 0.36.0 through 0.74.5 contains an inefficient algorithmic complexity vulnerability in maskActionContents that allows local attackers to exhaust the --listen HTTP server through quadratic string concatenation. Attackers can repeatedly send POST bodies of about 1 MB to the unauthenticated localhost port, blocking the single-threaded server for about 30 seconds each time.

Published 2026-10-22 · last modified 2026-10-22.

CVSS v3 metric

CVSS v3 base score 2.5 (Low). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Junegunn Fzf

Weakness classification (CWE)

CWE-407 — Inefficient Algorithmic Complexity

References

github.com/junegunn/fzf/commit/b412a450538e5f4a1d7057732e75d945dafa18a6 (patch)
github.com/junegunn/fzf/blob/v0.74.5/src/options.go (technical-description)
github.com/junegunn/fzf (product)
www.vulncheck.com/advisories/fzf-0.36.0-through-0.74.5-denial-of-service-via-ma… (third-party-advisory)

Frequently asked questions

What is CVE-2026-115319?: CVE-2026-115319 is a low-severity vulnerability in Junegunn Fzf, classified under Inefficient Algorithmic Complexity. CVSS score: 2.5/10. Published 2026-10-22.
How severe is CVE-2026-115319?: Low severity. CVSS v3 base score is 2.5 out of 10.