CVE-2026-73232: ffuf denial of service (OOM) via HTTP response decompression bomb

September 3, 2026

A malicious or attacker-controlled target server can crash ffuf with an out-of-memory condition by returning a compressed HTTP response that decompresses to a very large body (a decompression bomb). This works against default usage with no special flags.

References

github.com/advisories/GHSA-jcvh-xf52-2cwm
github.com/ffuf/ffuf/commit/fb0da86c60443b0dddbc9a86e91e3a6487dff79b
github.com/ffuf/ffuf/pull/897
github.com/ffuf/ffuf/releases/tag/v2.2.0
github.com/ffuf/ffuf/security/advisories/GHSA-jcvh-xf52-2cwm
nvd.nist.gov/vuln/detail/CVE-2026-73232

Code Behaviors & Features

Detect and mitigate CVE-2026-73232 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →