Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2026-53433 →
DEBIAN-CVE-2026-53433
fzf is vulnerable to a Denial of Service (DoS) due to inefficient HTTP body processing in the --listen mode due to inefficient HTTP body processing us...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
fzf is vulnerable to a Denial of Service (DoS) due to inefficient HTTP body processing in the --listen mode due to inefficient HTTP body processing using repeated string concatenation, resulting in quadratic time complexity (O(n²)). A crafted POST request with many small segments can trigger excessive CPU usage during request handling.This allows a single malicious request to monopolize the single‑threaded HTTP server, blocking all other clients and resulting in denial of service. This issue was fixed in version 0.73.1.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
fzf
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:13
fzf
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:14
fzf
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73.1-1"}]}]
Références
- advisory security-tracker.debian.org