CVE-2026-73232: Github.com/ffuf/ffuf/v2 Denial of Service Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-jcvh-xf52-2cwm",
  "modified" : "2026-09-03T18:02:09Z",
  "published" : "2026-09-03T18:02:09Z",
  "aliases" : [ "CVE-2026-73232" ],
  "summary" : "ffuf denial of service (OOM) via HTTP response decompression bomb",
  "details" : "### Summary\n\n  A malicious or attacker-controlled target server can crash ffuf with an out-of-memory condition by returning a compressed HTTP response that decompresses to a very large body (a decompression\n  bomb). This works against default usage with no special flags.\n\n  ### Details\n\n  The response body size guard in `pkg/runner/simple.go` only checks the server-supplied `Content-Length` header, which reflects the *compressed* size and is absent for chunked responses or when Go's\n  `net/http` transport transparently decompresses the body. After that check, `io.ReadAll` reads the entire *decompressed* stream into memory with no upper bound, so a small compressed body that\n  expands to gigabytes causes unbounded allocation and the process is terminated by the OS OOM killer.\n\n  The guard is bypassed in three independent ways:\n\n  1. **gzip (default configuration):** the transport requests gzip on its own and transparently decompresses the response, stripping `Content-Encoding` and `Content-Length`, so the size check is\n  skipped and the already-decoded body is read unbounded.\n  2. **brotli/deflate (or gzip with headers preserved):** `Content-Length` reflects the small compressed size and passes the check; the body is then manually decompressed into an unbounded\n  `io.ReadAll`.\n  3. **chunked transfer encoding:** no `Content-Length` header is present, so the numeric parse fails and the check is skipped entirely.\n\n  ### Impact\n\n  Denial of service against the operator running ffuf. A single hostile endpoint can OOM-kill ffuf on a default invocation such as `ffuf -u http://target/FUZZ -w wordlist.txt`, discarding all\n  in-memory scan results. Because the crash recurs on every attempt against that target, a server can effectively make itself immune to ffuf-based content discovery. There is no confidentiality or\n  integrity impact; only the availability of the scanning process is affected. CVSS 3.1 base score 7.5 (`AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`), CWE-409 (Improper Handling of Highly Compressed Data).\n\n  ### Patches\n\n  Fixed in **ffuf 2.2.0** (https://github.com/ffuf/ffuf/releases/tag/v2.2.0) via https://github.com/ffuf/ffuf/pull/897. The response body read is now bounded with `io.LimitReader` to the existing 5\n  MB download cap regardless of `Content-Encoding`, chunked framing, or transport-level decompression; responses exceeding the cap are dropped rather than read into memory. Upgrade to 2.2.0 or later.\n\n  ### Workarounds\n\n  There is no configuration flag that fully mitigates this in affected versions. Until upgrading, limit ffuf usage against untrusted or attacker-influenced targets. Upgrading to 2.2.0 is the fix.\n\n  ### Credits\n\n  Reported by **João Tricta** (Hakai Offensive Security).",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/ffuf/ffuf/v2"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.2.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 2.1.0"
    }
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/ffuf/ffuf"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "last_affected" : "1.5.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/ffuf/ffuf/security/advisories/GHSA-jcvh-xf52-2cwm"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-73232"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/ffuf/ffuf/pull/897"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/ffuf/ffuf/commit/fb0da86c60443b0dddbc9a86e91e3a6487dff79b"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/ffuf/ffuf"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/ffuf/ffuf/releases/tag/v2.2.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-409" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-09-03T18:02:09Z",
    "nvd_published_at" : "2026-08-11T20:18:48Z"
  }
}