Fzf vulnerabilities
We track 2 vulnerabilities in Fzf products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on June 30, 2026.
2vulnerabilities
0critical
2high
0exploited
7.5average CVSS score
Latest Fzf vulnerabilities
- 7.5 High severity
fzf: Inefficient Algorithmic Complexity
fzf is vulnerable to a Denial of Service (DoS) due to inefficient HTTP body processing in the --listen mode due to inefficient HTTP body processing using repeated string concatenation, resulting in quadratic time complexity (O(n²)). A crafted POST request with
- 7.5 High severity
fzf: Integer Overflow or Wraparound
fzf is vulnerable to Integer Overflow leading to crash in FuzzyMatchV2 function. When input line length is approximately 2,200,000 bytes and pattern length is 999 bytes, the product overflows. The Go runtime detects the invalid slice bounds and terminates the