Listen to this Post
Intro
ffuf is a fast web fuzzer written in Go. Prior to version 2.2.0, ffuf allowed a malicious target server to cause an out-of-memory denial of service via an HTTP response decompression bomb. The vulnerability resides in the response body size guard implemented in pkg/runner/simple.go. This guard only checks the server-supplied `Content-Length` header, which reflects the compressed size of the response body. After this check passes, `io.ReadAll` reads the entire decompressed stream into memory with no upper bound. A small compressed body that expands to gigabytes therefore causes unbounded memory allocation, and the process is terminated by the OS OOM killer.
The guard is bypassed in three independent ways:
- gzip (default configuration): The Go `net/http` transport requests gzip on its own and transparently decompresses the response, stripping `Content-Encoding` and `Content-Length` headers. The size check is skipped entirely, and the already-decoded body is read unbounded.
- brotli/deflate (or gzip with headers preserved): `Content-Length` reflects the small compressed size and passes the check. The body is then manually decompressed into an unbounded
io.ReadAll. - chunked transfer encoding: No `Content-Length` header is present, so the numeric parse fails and the check is skipped entirely.
This flaw allows a single hostile endpoint to OOM-kill ffuf on a default invocation such asffuf -u http://target/FUZZ -w wordlist.txt, discarding all in-memory scan results. Because the crash recurs on every attempt against that target, a server can effectively make itself immune to ffuf-based content discovery. There is no confidentiality or integrity impact; only the availability of the scanning process is affected. The CVSS 3.1 base score is 7.5 (High) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, and the weakness is mapped to CWE-409 (Improper Handling of Highly Compressed Data).
DailyCVE Form:
Platform: ffuf
Version: <2.2.0
Vulnerability: OOM decompression bomb
Severity: High (7.5)
Date: 2026-08-11
Prediction: Already patched (2.2.0)
What Undercode Say:
Check ffuf version ffuf -V Vulnerable versions (< 2.2.0) are affected Example default invocation that can be exploited: ffuf -u http://target/FUZZ -w wordlist.txt After upgrade, verify fix: ffuf -V Should show 2.2.0 or later
Exploit: (Educational Purposes!)
An attacker-controlled server can return a small compressed HTTP response (e.g., gzip, brotli, or deflate) that decompresses to an enormous size (a decompression bomb). The response can be served with:
– `Content-Encoding: gzip` while Go’s transport transparently decompresses it, stripping the size guard.
– `Content-Encoding: brotli` or `deflate` where `Content-Length` reflects only the compressed size.
– Chunked transfer encoding with no `Content-Length` header.
When ffuf sends a request to such an endpoint, `io.ReadAll` reads the entire decompressed stream into memory with no bound, causing unbounded allocation and OOM termination.
Protection:
Upgrade to ffuf 2.2.0 or later. The fix bounds the response body read with `io.LimitReader` to the existing 5 MB download cap regardless of Content-Encoding, chunked framing, or transport-level decompression; responses exceeding the cap are dropped rather than read into memory. There is no configuration flag that fully mitigates this in affected versions. Until upgrading, limit ffuf usage against untrusted or attacker-influenced targets.
Impact:
Denial of service against the operator running ffuf. A single hostile endpoint can OOM-kill ffuf on a default invocation, discarding all in-memory scan results. The crash recurs on every attempt against that target, allowing a server to effectively make itself immune to ffuf-based content discovery. No confidentiality or integrity impact; only availability of the scanning process is affected.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
