The vulnerability lies in fzf's HTTP listener, which processes incoming request bodies by repeatedly concatenating string segments. This results in quadratic time complexity and can consume excessive CPU when a crafted POST request contains many small segments. The impact is that a single malicious request can monopolize the single‑threaded HTTP server, blocking all other clients and causing a denial of service.

Affected systems include all releases of the fzf utility under the identifier fzf:fzf that are older than version 0.73.1. The issue applies only when the --listen mode is enabled, exposing the HTTP server. Versions 0.73., so users running those versions are not vulnerable. No other products or versions are affected according to the CNA data.

The CVSS base score of 5.7 indicates moderate severity. Because the exploit requires only network access to the HTTP listener and does not depend on privileged credentials, any host that exposes this listener—whether public or internal—could be targeted. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remotely sending a crafted POST request to the HTTP listener; once triggered, the CPU‑intensive operation can stall the service for all connected clients.