Description

ffuf is a fast web fuzzer written in Go. Prior to 2.2.0, ffuf allows a malicious target server to cause an out-of-memory denial of service because the response size guard in pkg/runner/simple.go checks only the compressed Content-Length while io.ReadAll reads gzip, brotli, deflate, transparently decompressed, or chunked response bodies without a decompressed-size bound. This issue is fixed in version 2.2.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-11T20:18:48.543Z",
  "pubdate": "2026-08-11T20:18:48.543Z",
  "executiveSummary": "An out-of-memory denial of service vulnerability exists in ffuf prior to version 2.2.0.\nThe vulnerability type is resource exhaustion leading to a denial of service, impacting the availability of the scanning system.\nThe affected product is ffuf, a fast web fuzzer written in Go, specifically versions prior to 2.2.0.\nThe risk implications include potential operational disruption, instability of the scanning infrastructure, and premature termination of security assessments when interacting with untrusted or adversarial target servers.\nAn attacker controlling a malicious target server possesses the capability to trigger this condition by responding to ffuf requests with a disproportionately large decompressed payload relative to the declared Content-Length.\nExploitation requires the ffuf client to initiate an HTTP request against a malicious or compromised target server that deliberately weaponizes HTTP response compression mechanisms.",
  "technicalDetails": "The root cause of the vulnerability resides in pkg/runner/simple.go, where the response size guard mechanism exclusively evaluates the compressed Content-Length header of the HTTP response rather than enforcing a strict maximum threshold on the actual decompressed body size.\nDuring execution, ffuf utilizes io.ReadAll to consume response bodies that may be encoded using gzip, brotli, deflate, transparent decompression, or chunked transfer encodings.\nBecause io.ReadAll reads the stream until EOF without a decompressed-size bound, a malicious server can transmit a small compressed payload that expands exponentially upon decompression.\nThe step-by-step attack flow proceeds as follows: First, the user executes ffuf against a target server under the control of the attacker. Second, ffuf sends a standard HTTP request to the target. Third, the malicious server responds with a heavily compressed payload possessing a small compressed Content-Length header that bypasses the simple.go validation check. Fourth, ffuf accepts the response and invokes io.ReadAll to process the incoming stream while the underlying transport or decompression wrapper transparently expands the data. Fifth, the rapidly expanding data stream exhausts the available system memory, triggering an out-of-memory panic and abruptly terminating the ffuf process.\nThe vulnerable component is the response handling logic implemented within pkg/runner/simple.go.\nAffected versions include all releases of ffuf prior to version 2.2.0.\nAuthentication and privilege requirements are absent, as the vulnerability is triggered entirely through standard HTTP response interactions initiated during normal fuzzing operations.\nNetwork exposure is inherent to the web fuzzing process, requiring interaction with arbitrary target web servers over HTTP or HTTPS.\nPost-exploitation impact is strictly limited to denial of service through application crashes and does not inherently facilitate remote code execution or unauthorized data access."
}