fzf’s maskActionContents function contains an inefficient algorithmic complexity flaw that can be exploited locally to exhaust the single‑threaded HTTP listen server. By repeatedly sending POST bodies of around 1 MB to the unauthenticated localhost port, an attacker can force the server to spend about 30 seconds per request on quadratic string concatenation, resulting in a temporary denial of service. The weakness is classified as CWE‑407, indicating the excessive resource consumption caused by the algorithm.

The vulnerability affects the fzf utility produced by junegunn. All releases from version 0.36.0 up through 0.74.5 are impacted. Users installing these releases, regardless of platform, are at risk.

The CVSS score of 2 marks this as low severity, and no EPSS data is available; the vulnerability is not listed in CISA KEV. Exploitation requires local access to the host that runs the --listen option, meaning an attacker must be able to reach the local port. If the service is exposed externally, the threat increases, but the impact remains a short 30‑second service interruption per malicious request, not a permanent compromise of confidentiality or integrity.