CVE-2026-73232 is a high-severity vulnerability affecting github.com/ffuf/ffuf/v2, with a CVSS score of 7.5, that allows a malicious or attacker-controlled target server to crash ffuf with an out-of-memory condition by returning a compressed HTTP response that decompresses to a very large body, known as a decompression bomb. This works against default usage without requiring special flags. The vulnerability occurs because the response body size guard only checks the server-supplied Content-Length header, which reflects the compressed size and may be absent for chunked responses or when Go's net/http transport transparently decompresses the body. The entire decompressed stream is then read into memory without an upper limit, allowing a small compressed response to expand to gigabytes and trigger the OS OOM killer. The guard can be bypassed through gzip, Brotli/deflate or preserved gzip headers, and chunked transfer encoding. The vulnerability results in a denial of service against the operator running ffuf, potentially discarding in-memory scan results, with no confidentiality or integrity impact and only availability affected.
We recommend you to update github.com/ffuf/ffuf/v2 to version 2.2.1 or later.[/subscribe_to_unlock_form]
CVE-2026-73232 is a high-severity vulnerability affecting github.com/ffuf/ffuf/v2, with a CVSS score of 7.5, that allows a malicious or attacker-controlled target server to crash ffuf with an out-of-memory condition by returning a compressed HTTP response that decompresses to a very large body, known as a decompression bomb. This works against default usage without requiring special flags. The vulnerability occurs because the response body size guard only checks the server-supplied Content-Length header, which reflects the compressed size and may be absent for chunked responses or when Go's net/http transport transparently decompresses the body. The entire decompressed stream is then read into memory without an upper limit, allowing a small compressed response to expand to gigabytes and trigger the OS OOM killer. The guard can be bypassed through gzip, Brotli/deflate or preserved gzip headers, and chunked transfer encoding. The vulnerability results in a denial of service against the operator running ffuf, potentially discarding in-memory scan results, with no confidentiality or integrity impact and only availability affected.
We recommend you to update github.com/ffuf/ffuf/v2 to version 2.2.1 or later.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]