This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-53433 →
DEBIAN-CVE-2026-53433
fzf is vulnerable to a Denial of Service (DoS) due to inefficient HTTP body processing in the --listen mode due to inefficient HTTP body processing us...
Original description
The description as published by the source.
fzf is vulnerable to a Denial of Service (DoS) due to inefficient HTTP body processing in the --listen mode due to inefficient HTTP body processing using repeated string concatenation, resulting in quadratic time complexity (O(n²)). A crafted POST request with many small segments can trigger excessive CPU usage during request handling.This allows a single malicious request to monopolize the single‑threaded HTTP server, blocking all other clients and resulting in denial of service. This issue was fixed in version 0.73.1.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:12
fzf
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:13
fzf
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:14
fzf
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73.1-1"}]}]
References
- advisory security-tracker.debian.org