CVE-2026-73232

Received Received - Intake

ffuf Denial of Service via Unbounded Response Size

Publication date: 2026-08-11

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description

ffuf is a fast web fuzzer written in Go. Prior to 2.2.0, ffuf allows a malicious target server to cause an out-of-memory denial of service because the response size guard in pkg/runner/simple.go checks only the compressed Content-Length while io.ReadAll reads gzip, brotli, deflate, transparently decompressed, or chunked response bodies without a decompressed-size bound. This issue is fixed in version 2.2.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-12

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-73232

EUVD

EUVD-2026-56926

Affected Vendors & Products

Vendor	Product	Version / Range
ffuf	ffuf	2.2.0
ffuf	ffuf	to 2.2.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-409	The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Attack-Flow Graph

Executive Summary

CVE-2026-73232 is a denial-of-service vulnerability in ffuf, a web fuzzer tool. It allows a malicious server to crash the application by sending a small compressed response that decompresses to a massive size, causing an out-of-memory condition. The issue occurs because ffuf only checked the compressed Content-Length header, not the decompressed size, allowing decompression bomb attacks.

Detection Guidance

To detect this vulnerability, check if your ffuf version is below 2.2.0 by running: ffuf -version. If it shows a version <= 2.1.0, the system is vulnerable. Monitor for out-of-memory (OOM) crashes during web fuzzing operations.

Impact Analysis

This vulnerability can cause ffuf to crash repeatedly when interacting with a malicious server, preventing normal operation. It may disrupt web fuzzing tasks, waste system resources, and require manual intervention to restart the tool. The impact is limited to availability, with no data confidentiality or integrity loss.

Compliance Impact

This vulnerability primarily impacts availability by causing out-of-memory crashes, which could disrupt services processing sensitive data. While it does not directly affect confidentiality or integrity, prolonged downtime may lead to violations of availability requirements in GDPR or HIPAA if systems fail to operate as intended during critical operations.

Mitigation Strategies

Upgrade ffuf to version 2.2.0 or later immediately. If upgrading is not possible, avoid using ffuf against untrusted targets until patched. The vulnerability has no effective workarounds other than upgrading.

Hi! I’m here to help you understand CVE-2026-73232. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70