CVE-2026-26201: Github.com/jm33 m0/emp3r0r/core Denial of Service Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-f5p9-j34q-pwcc",
  "modified" : "2026-02-19T21:56:27Z",
  "published" : "2026-02-17T21:27:58Z",
  "aliases" : [ "CVE-2026-26201" ],
  "summary" : "emp3r0r Affected by Concurrent Map Access DoS (panic/crash)",
  "details" : "## Summary\n\nMultiple shared maps are accessed without consistent synchronization across goroutines. Under concurrent activity, Go runtime can trigger `fatal error: concurrent map read and map write`, causing C2 process crash (availability loss).\n\n## Vulnerable Component(with code examples)\n\nOperator relay map had mixed access patterns (iteration and mutation without a single lock policy):\n\n```go\n// vulnerable pattern (operator session map)\nfor sessionID, op := range OPERATORS { // iteration path\n    ...\n}\n\n// concurrent mutation path elsewhere\nOPERATORS[operatorSession] = &operator_t{...}\ndelete(OPERATORS, operatorSession)\n```\n\nPort-forwarding session map had read/write paths guarded inconsistently:\n\n```go\n// vulnerable pattern (port forward map)\nif sess, ok := PortFwds[id]; ok { // read path\n    ...\n}\n\nPortFwds[id] = newSession // write path\ndelete(PortFwds, id)      // delete path\n```\n\nFTP stream map similarly mixed concurrent iteration with mutation:\n\n```go\n// vulnerable pattern (FTP stream map)\nfor token, stream := range FTPStreams { // iteration path\n    ...\n}\n\nFTPStreams[token] = stream // write path\ndelete(FTPStreams, token)  // delete path\n```\n\n## Attack Vector\n\n1. Attacker (or stress traffic in authenticated flows) triggers high concurrency in normal control paths.\n2. Operator sessions connect/disconnect while message forwarding and file-transfer workflows are active.\n3. Concurrent read/write hits shared maps.\n4. Go runtime panics with concurrent map read/write error.\n5. C2 component exits, producing denial of service.\n\n## Proof of Concept\n\n1. Start C2 server with active operator session(s) in a lab environment.\n2. Generate rapid operator session churn (connect/disconnect loops).\n3. Simultaneously drive agent message tunnel traffic and/or file transfer activity.\n4. Observe crash signature in logs: `fatal error: concurrent map read and map write`.\n5. Optional: run with race detector in dev build to confirm race locations.\n\n## Impact\n\n- C2 service interruption due to process panic/crash.\n- Operational instability under load or deliberate churn.\n- Repeated crash-restart cycles can degrade command reliability and incident response workflows.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/jm33-m0/emp3r0r/core"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.0.0-20260212232424-ea4d074f081d"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/jm33-m0/emp3r0r/security/advisories/GHSA-f5p9-j34q-pwcc"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-26201"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/jm33-m0/emp3r0r/commit/ea4d074f081dac6293f3aec38f01def5f08d5af5"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/jm33-m0/emp3r0r"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/jm33-m0/emp3r0r/releases/tag/v3.21.2"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-362", "CWE-663" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-02-17T21:27:58Z",
    "nvd_published_at" : "2026-02-19T20:25:42Z"
  }
}