fzf’s maskActionContents function contains an inefficient algorithmic complexity flaw that can be exploited locally to exhaust the single‑threaded HTTP listen server. By repeatedly sending POST bodies of around 1 MB to the unauthenticated localhost port, an attacker can force the server to spend about 30 seconds per request on quadratic string concatenation, resulting in a temporary denial of service. The weakness aligns with CWE‑407, indicating excessive resource consumption, and also reflects CWE‑1046, indicating performance degradation caused by the algorithm.

The vulnerability affects the fzf utility produced by junegunn. All releases from version 0.36.0 up through 0.74.5 are impacted. Users installing these releases, regardless of platform, are at risk.

The CVSS score of 2 marks this as low severity, and the EPSS score of < 1% indicates a very low but non‑zero chance of exploitation; the vulnerability is not listed in CISA KEV. Exploitation requires local access to the host that runs the --listen option, so an attacker must be able to reach the local port. The impact is a temporary 30‑second service interruption per malicious request, with no permanent compromise of confidentiality or integrity.