Tags · ffuf/ffuf

Repository navigation

v2.3.0

ffuf v2.3.0

New
  - preflight/postflight raw HTTP requests with regex variable extraction
    (-preflight/-postflight, -preflight-var, -preflight-mode, -preflight-error)

Security
  - The response snapshot taken for -od and -audit-log read the whole response
    body with no size limit, ahead of the MAX_DOWNLOAD_SIZE cap, so a scanned
    target could exhaust the scanner's memory and disk. The body is now bounded
    before anything reads it, response headers are bounded as well, and
    -ignore-body now applies to chunked responses. This path was not covered by
    the fix for CVE-2026-73232.

Changed
  - Interactive console no longer scrolled off screen by inflight results
  - Terminal control characters no longer leak into redirected output
  - Scraper FromDir reads its dirname argument rather than the global directory
  - Concurrency fixes in MatcherManager, the recursion queue and the pause gate
  - Autocalibration no longer mutates the caller's input map
  - Stdoutput result accumulation is synchronized
  - Response words and lines counted without an intermediate allocation
  - Internal: pkg/ffuf split into a kernel plus pkg/engine, recursion policy
    extracted into a recursion manager, declarative flag/config architecture

Sep 9, 2026
256c1b0
zip
tar.gz
Notes
Downloads

v2.2.1

ffuf v2.2.1

Release version is now derived from the git tag at build time, so the
reported version (ffuf -V / banner) matches the release again (fixes the
regression from #901). Development builds report git-<date>-<commit>.

Jul 13, 2026
1571aa1
zip
tar.gz
Notes
Downloads

v2.2.0

ffuf v2.2.0

Security
- Fix gzip-bomb OOM: bound decompressed response body size (CWE-409, #897).
  A malicious target server could crash ffuf via a decompression bomb on
  default configuration. Reported by João Tricta (Hakai Offensive Security).

CI
- Release builds now run in GitHub Actions via goreleaser v2 (#898, #899).