CVE-2026-53433: Junegunn Fzf DoS Vulnerability

CVE-2026-53433 Overview

CVE-2026-53433 is a Denial of Service (DoS) vulnerability in fzf, the popular command-line fuzzy finder maintained by junegunn. The flaw resides in the HTTP server exposed by the --listen mode, where request body accumulation uses repeated string concatenation. This produces quadratic time complexity (O(n²)) when processing a request body composed of many small segments. A crafted POST request can force the single-threaded HTTP server to consume excessive CPU while parsing the body, blocking all other clients. The issue is tracked under CWE-407: Inefficient Algorithmic Complexity and was fixed in fzf version 0.73.1.

Critical Impact
A single crafted local HTTP request can monopolize the fzf --listen server, causing sustained CPU exhaustion and denying service to legitimate clients.

Affected Products

junegunn fzf versions prior to 0.73.1
Any workflow or integration that exposes fzf --listen on a local port
Editor plugins and tooling that embed the fzf HTTP listener

Discovery Timeline

2026-06-30 - CVE-2026-53433 published to the National Vulnerability Database (NVD)
2026-07-02 - Last updated in NVD database
Patch commit 7963a2c published in the junegunn/fzf repository

Technical Details for CVE-2026-53433

Vulnerability Analysis

The vulnerability originates in the handleHttpRequest function inside src/server.go. The pre-patch implementation accumulated the incoming HTTP body into a Go string variable using repeated concatenation. In Go, strings are immutable, so each concatenation allocates a new backing array and copies all previously accumulated bytes. Handling a body split across n segments therefore performs work proportional to n².

An attacker with local access to the listener can submit a POST request whose body is delivered in many small chunks. The server spends increasing time on each concatenation while the single-threaded HTTP handler is unable to service other connections. Because fzf --listen is often used for editor integrations and interactive tooling, the outage is immediately visible to the user.

Root Cause

The root cause is inefficient algorithmic behavior [CWE-407] rather than a memory safety flaw. The fix replaces the mutable string accumulator with a strings.Builder, which amortizes appends in linear time.

Attack Vector

Exploitation requires local access with low privileges and no user interaction. The attacker sends a specially crafted POST request to the fzf listener port. Only availability is affected — confidentiality and integrity are not impacted.

 func (server *httpServer) handleHttpRequest(conn net.Conn) string {
 	contentLength := 0
 	apiKey := ""
-	body := ""
+	var bodyBuilder strings.Builder
 	answer := func(code string, message string) string {
 		message += "\n"
 		return code + fmt.Sprintf("Content-Length: %d%s", len(message), crlf+crlf+message)
// Source: https://github.com/junegunn/fzf/commit/7963a2c6586c0b9eaa89b8995de8f0e08cf8a4ce

The patch swaps the immutable string accumulator for strings.Builder, converting body assembly from O(n²) to O(n).

Detection Methods for CVE-2026-53433

Indicators of Compromise

Sustained high CPU usage attributed to an fzf process bound to a local listener port.
Unresponsive editor or shell integrations that depend on fzf --listen.
Local POST requests to the fzf listener with unusually fragmented or oversized bodies.

Detection Strategies

Monitor fzf process CPU time on hosts where the --listen flag is enabled and alert on prolonged saturation of a single core.
Inspect local HTTP traffic to the configured listener port for POST requests exhibiting many small TCP segments or chunked bodies.
Inventory installed fzf binaries and flag any version earlier than 0.73.1.

Monitoring Recommendations

Track process-level CPU and wall-clock metrics for fzf and correlate spikes with local socket activity.
Log invocations of fzf --listen in shell history and CI environments to identify unexpected exposure.
Review the junegunn/fzf security history for related advisories and follow-up patches.

How to Mitigate CVE-2026-53433

Immediate Actions Required

Upgrade fzf to version 0.73.1 or later on all systems.
Audit editor plugins, shell scripts, and automation that invoke fzf --listen and confirm they run against a patched binary.
Disable --listen mode where it is not required for a workflow.

Patch Information

The fix is available in fzf0.73.1 and is implemented in commit 7963a2c. Additional context is available in the CERT Polska advisory covering the related fzf listener issues.

Workarounds

Avoid launching fzf with the --listen option until upgrading is possible.
Bind the listener to 127.0.0.1 and restrict access to trusted local users through OS-level controls.
Terminate any long-running fzf --listen processes and restart them with the patched binary.

bash

# Verify installed version and upgrade
fzf --version

# Homebrew
brew upgrade fzf

# Go install
go install github.com/junegunn/fzf@v0.73.1

# Confirm patched version
fzf --version | grep -E '0\.(73\.[1-9]|7[4-9]|[89][0-9])'