CVE-2026-53433

Name of the Vulnerable Software and Affected Versions fzf versions prior to 0.73.1

Description Inefficient HTTP body processing in --listen mode leads to a Denial of Service (DoS). The issue stems from repeated string concatenation during the handling of POST requests, which results in quadratic time complexity (O(n²)). A crafted request containing numerous small segments can cause excessive CPU usage, allowing a single malicious request to monopolize the single-threaded HTTP server and block all other clients.

Recommendations Update to version 0.73.1.