CVE-2026-73232

Name of the Vulnerable Software and Affected Versions ffuf versions prior to 2.2.0

Description A malicious target server can trigger an out-of-memory denial of service. This occurs because the response size guard in the pkg/runner/simple.go file only verifies the compressed Content-Length, whereas the io.ReadAll() function reads gzip, brotli, deflate, transparently decompressed, or chunked response bodies without a bound on the decompressed size.

Recommendations Update to version 2.2.0.