This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-73232 →

UBUNTU-CVE-2026-73232

ffuf is a fast web fuzzer written in Go. Prior to 2.2.0, ffuf allows a malicious target server to cause an out-of-memory denial of service because the...

Original description

The description as published by the source.

ffuf is a fast web fuzzer written in Go. Prior to 2.2.0, ffuf allows a malicious target server to cause an out-of-memory denial of service because the response size guard in pkg/runner/simple.go checks only the compressed Content-Length while io.ReadAll reads gzip, brotli, deflate, transparently decompressed, or chunked response bodies without a decompressed-size bound. This issue is fixed in version 2.2.0.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Ubuntu:22.04:LTS ffuf

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:Pro:24.04:LTS ffuf

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:26.10 ffuf

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:26.04:LTS ffuf

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

References

report ubuntu.com
report cve.org
report github.com
report github.com
report github.com
report github.com