CVE-2026-73232: ffuf
Vulnerability summary
CVE-2026-73232 is a high (CVSS 7.5) vulnerability in ffuf. EPSS estimates a 0.63% chance of exploitation in the next 30 days, higher than 49.1% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 3 · Related 3Timeline
- 11-08-2026PublishedVulnerability first disclosed.
- 12-08-2026Last modifiedVulnerability information updated.
Description
ffuf is a fast web fuzzer written in Go. Prior to 2.2.0, ffuf allows a malicious target server to cause an out-of-memory denial of service because the response size guard in pkg/runner/simple.go checks only the compressed Content-Length while io.ReadAll reads gzip, brotli, deflate, transparently decompressed, or chunked response bodies without a decompressed-size bound. This issue is fixed in version 2.2.0.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · GoEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.63%
Chance of exploitation in the next 30 days
Percentile
49%
Versus all other CVEs
30-day change
+0.19 pp
From 0.44% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- ffufAll versions (No fix recorded) | < 2.2.1-1
Ffuf1 product
- ffuf< 2.2.0
Github.com/ffuf1 product
- ffuf≤ 1.5.0 | All versions (No fix recorded)
Github.com/ffuf/ffuf1 product
- v2< 2.2.0
Ubuntu1 product
- ffufAll versions (No fix recorded)
5 vendors · 5 products
References
9 links
- github.com/ffuf/ffufPACKAGE