| Release | Version |
|---|---|
| bookworm | 0.38.0-1 |
| trixie | 0.60.3-1 |
| forky | 0.74.5-1 |
| sid | 0.74.5-1 |
| Bug | bookworm | trixie | forky | sid | Description |
|---|---|---|---|---|---|
| TEMP-0000000-F8CFBB | vulnerable | vulnerable (no DSA) | fixed | fixed | GHSA-w6x2-f5m4-xw82: Arbitrary command execution via bash arithmetic expansion on unvalidated layout size in fzf-tmux (-l/-u attached value) |
| TEMP-0000000-717A4A | vulnerable | vulnerable (no DSA) | fixed | fixed | GHSA-7rj6-7pqx-v7rm: Predictable FIFO path in zsh completion allows local symlink attack / arbitrary file overwrite as the victim user (_fzf_feed_fifo) |
| Bug | bookworm | trixie | forky | sid | Description |
|---|---|---|---|---|---|
| CVE-2026-115319 | vulnerable | vulnerable | vulnerable | vulnerable | fzf 0.36.0 through 0.74.5 contains an inefficient algorithmic complexi ... |
| CVE-2026-53433 | vulnerable | vulnerable | fixed | fixed | fzf is vulnerable to a Denial of Service (DoS) due to inefficient HTTP ... |
| CVE-2026-53432 | vulnerable | vulnerable | fixed | fixed | fzf is vulnerable toInteger Overflow leading to crash in FuzzyMatchV2 ... |