CyberRota Analysis
AI-GeneratedThe vulnerability in ffuf affects versions prior to 2.2.0, allowing a malicious target server to trigger an out-of-memory denial of service by exploiting inadequate response size checks during decompression. This can lead to service interruptions for applications relying on ffuf for web fuzzing. Organizations using ffuf for security testing should prioritize upgrading to version 2.2.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ffuf is a fast web fuzzer written in Go. Prior to 2.2.0, ffuf allows a malicious target server to cause an out-of-memory denial of service because the response size guard in pkg/runner/simple.go checks only the compressed Content-Length while io.ReadAll reads gzip, brotli, deflate, transparently decompressed, or chunked response bodies without a decompressed-size bound. This issue is fixed in version 2.2.0.