fzf integer overflow and DoS flaws fixed
Two vulnerabilities in fzf—an integer overflow causing crashes and a DoS via inefficient HTTP body processing in listen mode—were patched in version 0.73.1.
CERT Polska coordinated disclosure of two vulnerabilities affecting fzf, a command-line fuzzy finder tool. CVE-2026-53432 is an integer overflow vulnerability in the FuzzyMatchV2 function triggered when processing input lines of approximately 2.2 million bytes with 999-byte patterns, causing the Go runtime to panic and terminate the process. CVE-2026-53433 is a denial-of-service vulnerability in fzf's --listen mode, where inefficient HTTP body processing using repeated string concatenation results in quadratic time complexity. An attacker can craft POST requests with many small segments to trigger excessive CPU usage, monopolizing the single-threaded HTTP server and blocking legitimate clients.
Both vulnerabilities were discovered by researchers from the AFINE Team and reported through CERT Polska's coordinated vulnerability disclosure process. The issues have been addressed in fzf version 0.73.1. Organizations using fzf, particularly in environments where the --listen mode is exposed to untrusted input, should update to the patched version promptly.
Mentioned in this report
Detection guidance
fzf --listen Mode Bound to Non-Loopback Interface
Detects fzf launched with --listen flag bound to a non-loopback address, exposing its single-threaded HTTP server (vulnerable to CVE-2026-53433 quadratic-time DoS) to untrusted network input. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: fzf Listen Mode Exposed on Non-Loopback Interface
id: ef38385e-8001-5409-b93b-8b9044abc045
status: experimental
description: 'Detects fzf being started with the --listen flag bound to an address
other than localhost/127.0.0.1,
exposing its built-in HTTP server to the network. This server is affected by CVE-2026-53433,
a
quadratic-time-complexity DoS in HTTP body parsing that can be triggered with many
small POST
segments, and by CVE-2026-53432, an integer overflow causing process crash. Exposing
--listen
beyond loopback significantly increases the attack surface for these issues.
'
references:
- CERT Polska CVE-2026-53432 / CVE-2026-53433 advisory
author: Vorant
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- \fzf.exe
CommandLine|contains: --listen
filter_loopback:
CommandLine|contains:
- 127.0.0.1
- localhost
- --listen 0
condition: selection and not filter_loopback
falsepositives:
- Legitimate internal tooling intentionally exposing fzf --listen on a private management
network
- Developers testing fzf remote control integrations on non-default interfaces
level: medium
tags:
- attack.t1499.004
fzf Process Started with Listen and Bind Flags Indicating Remote Control Exposure
Detects fzf command-line invocation combining --listen with an explicit bind address/port, a pattern that indicates the vulnerable HTTP remote-control server is being enabled, potentially for exploitation of the FuzzyMatchV2 integer overflow or listen-mode DoS. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: fzf Remote Control HTTP Server Enabled via Listen Flag
id: ab9a22c3-ca22-5c4d-a97e-b6291deab25b
status: experimental
description: 'Detects execution of fzf with the --listen (or --listen-unsafe) flag,
which starts a
single-threaded HTTP server used for remote control. Versions prior to 0.73.1 are
affected
by CVE-2026-53433 (quadratic-time HTTP body processing DoS) and CVE-2026-53432 (integer
overflow crash in FuzzyMatchV2). Presence of this flag on servers or shared systems
should be
reviewed, especially where the process is reachable from untrusted networks.
'
references:
- CERT Polska CVE-2026-53432 / CVE-2026-53433 advisory
author: Vorant
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith: /fzf
CommandLine|contains:
- --listen
- --listen-unsafe
condition: selection
falsepositives:
- Developers or CI pipelines intentionally using fzf remote-control feature for automation
on trusted, isolated hosts
level: low
tags:
- attack.t1499.004
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-53432/
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free