CVE-2026-73232

CVE-2026-73232 is a memory exhaustion vulnerability in ffuf versions prior to 2.2.0 where a malicious server can force the tool to allocate gigabytes of memory by returning a small compressed payload that decompresses to enormous size. The root cause is a bounding mismatch: ffuf checks Content-Length on the compressed response stream, but uses io.ReadAll with transparent gzip decompression that imposes no decompressed-size limit. A 200-byte gzip payload decompressing to multiple gigabytes triggers uncontrolled memory allocation before any guard can fire. The vulnerability inverts ffuf's trust model. The tool was designed with an assumption that target servers are cooperative—reasonable for normal HTTP clients, but dangerous for reconnaissance tooling that routinely scans untrusted infrastructure including honeypots and potentially compromised servers. An attacker who controls a server that ffuf scans can weaponize this trust assumption to exhaust the operator's memory, effectively turning ffuf into a DDoS vector against itself. The fix in 2.2.0 presumably adds a bounded reader on the decompressed stream, likely using a LimitedReader pattern. The threshold value matters: if set too low, ffuf will silently truncate legitimate responses from servers with high-compression-ratio payloads, causing the operator to miss fuzzing results without realizing data was lost. That trades one failure mode for another, and the threshold determines whether the fix creates new blind spots. For defenders: verify your ffuf installation is 2.2.0 or later. If running older versions in containers or CI pipelines, update immediately—this is not a vulnerability that eradicates itself. Be aware that scanning hostile infrastructure with any pre-2.2.0 ffuf binary creates memory exhaustion risk and potentially signals your reconnaissance activity to whoever controls the target server. Consider whether your scanning targets could be honeypots designed to exploit this pattern.

Reviewed through automated stages and approved by a human before publication.