Ffuf security scanner can be crashed by hostile sites

Published September 3, 2026 CVE-2026-73232

Ffuf is a free tool that security testers use to scan websites for hidden pages and files. A hostile or hacked target website can send back a reply that quietly expands to gigabytes of data once ffuf unpacks it, which eats up all available memory and crashes the scan.

Severity
HighCVSS 3.1 · 7.5
Fix
Fixed in 2.2.0Fix recorded on Sep 3, 2026
Affected versions
2.1.0 or older; 1.5.0 or older
Weakness
CWE-409
Exploit likelihood
0.44% in 30 daysEPSS, higher than 37% of known flaws
Affects
ffuf/ffuf/v2

How it works

Ffuf checks whether a server reply is too large by reading only the compressed size the server reports, then unpacks gzip, brotli, deflate, or chunked replies with no limit on how big the unpacked data can get, so a small reply that balloons into gigabytes slips past the check.

What to do

Run ffuf -V to see the installed version. Github.com/ffuf/ffuf/v2 releases 2.1.0 and earlier and the older github.com/ffuf/ffuf package at 1.5.0 and earlier are vulnerable. Update to ffuf 2.2.0 or later, for example with go install github.com/ffuf/ffuf/v2@latest, which adds a cap on how much decompressed data ffuf will read.

Update github.com/ffuf/ffuf/v2 to 2.2.0 or newer. Then verify the installed version.

Technical details

Affected software: ffuf/ffuf/v2

The size guard in pkg/runner/simple.go only checks the server-supplied Content-Length header, which reflects the compressed size. Go's net/http transport auto-decompresses gzip and strips Content-Length before the guard runs, so gzip bombs bypass it under default settings; brotli, deflate, and chunked-encoding responses bypass it too, since Content-Length is either irrelevant or absent. io. ReadAll then reads the fully decompressed body into memory with no upper bound, so a small compressed payload expanding to gigabytes triggers unbounded allocation and an OS out-of-memory kill. Fixed in ffuf 2.2.0.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact None No data disclosure
  • Integrity impact None No data tampering
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Open in FIRST.org calculator

References

View Original Source