This vulnerability allows a malicious target server to cause ffuf, a fast web fuzzer, to consume excessive memory and crash. A response with a compressed payload whose decompressed size is not bounded triggers an out‑of‑memory upon reading. This results in denial of service to the fuzzer process, potentially disrupting automated reconnaissance or testing activities. The weakness is a size guard failure during input stream handling (CWE‑409).

All installations of ffuf before version 2.2.0 are affected. The fix was introduced in commit fb0da86c6 and is included in release 2.2.0, so any ffuf instance older than that is vulnerable.

The CVSS score of 7.5 indicates a high risk severity, but the EPSS score is under 1%, suggesting a very low exploitation probability and the vulnerability is not listed in the CISA KEV catalog. Attackers must control a target server that ffuf contacts and craft a compressed HTTP response that decompresses to a large size without an enforced decompressed‑size bound, making a decompression bomb viable. The result is an out‑of‑memory condition that crashes ffuf, disabling the fuzzing operation.