GHSA-F5P9-J34Q-PWCC

Vulnerability from github – Published: 2026-02-17 21:27 – Updated: 2026-02-19 21:56
VLAI
Summary
emp3r0r Affected by Concurrent Map Access DoS (panic/crash)
Details

Summary

Multiple shared maps are accessed without consistent synchronization across goroutines. Under concurrent activity, Go runtime can trigger fatal error: concurrent map read and map write, causing C2 process crash (availability loss).

Vulnerable Component(with code examples)

Operator relay map had mixed access patterns (iteration and mutation without a single lock policy):

// vulnerable pattern (operator session map)
for sessionID, op := range OPERATORS { // iteration path
    ...
}

// concurrent mutation path elsewhere
OPERATORS[operatorSession] = &operator_t{...}
delete(OPERATORS, operatorSession)

Port-forwarding session map had read/write paths guarded inconsistently:

// vulnerable pattern (port forward map)
if sess, ok := PortFwds[id]; ok { // read path
    ...
}

PortFwds[id] = newSession // write path
delete(PortFwds, id)      // delete path

FTP stream map similarly mixed concurrent iteration with mutation:

// vulnerable pattern (FTP stream map)
for token, stream := range FTPStreams { // iteration path
    ...
}

FTPStreams[token] = stream // write path
delete(FTPStreams, token)  // delete path

Attack Vector

  1. Attacker (or stress traffic in authenticated flows) triggers high concurrency in normal control paths.
  2. Operator sessions connect/disconnect while message forwarding and file-transfer workflows are active.
  3. Concurrent read/write hits shared maps.
  4. Go runtime panics with concurrent map read/write error.
  5. C2 component exits, producing denial of service.

Proof of Concept

  1. Start C2 server with active operator session(s) in a lab environment.
  2. Generate rapid operator session churn (connect/disconnect loops).
  3. Simultaneously drive agent message tunnel traffic and/or file transfer activity.
  4. Observe crash signature in logs: fatal error: concurrent map read and map write.
  5. Optional: run with race detector in dev build to confirm race locations.

Impact

  • C2 service interruption due to process panic/crash.
  • Operational instability under load or deliberate churn.
  • Repeated crash-restart cycles can degrade command reliability and incident response workflows.
Severity
7.0 (High)
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/jm33-m0/emp3r0r/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20260212232424-ea4d074f081d"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-26201"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-362",
      "CWE-663"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-17T21:27:58Z",
    "nvd_published_at": "2026-02-19T20:25:42Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nMultiple shared maps are accessed without consistent synchronization across goroutines. Under concurrent activity, Go runtime can trigger `fatal error: concurrent map read and map write`, causing C2 process crash (availability loss).\n\n## Vulnerable Component(with code examples)\n\nOperator relay map had mixed access patterns (iteration and mutation without a single lock policy):\n\n```go\n// vulnerable pattern (operator session map)\nfor sessionID, op := range OPERATORS { // iteration path\n    ...\n}\n\n// concurrent mutation path elsewhere\nOPERATORS[operatorSession] = \u0026operator_t{...}\ndelete(OPERATORS, operatorSession)\n```\n\nPort-forwarding session map had read/write paths guarded inconsistently:\n\n```go\n// vulnerable pattern (port forward map)\nif sess, ok := PortFwds[id]; ok { // read path\n    ...\n}\n\nPortFwds[id] = newSession // write path\ndelete(PortFwds, id)      // delete path\n```\n\nFTP stream map similarly mixed concurrent iteration with mutation:\n\n```go\n// vulnerable pattern (FTP stream map)\nfor token, stream := range FTPStreams { // iteration path\n    ...\n}\n\nFTPStreams[token] = stream // write path\ndelete(FTPStreams, token)  // delete path\n```\n\n## Attack Vector\n\n1. Attacker (or stress traffic in authenticated flows) triggers high concurrency in normal control paths.\n2. Operator sessions connect/disconnect while message forwarding and file-transfer workflows are active.\n3. Concurrent read/write hits shared maps.\n4. Go runtime panics with concurrent map read/write error.\n5. C2 component exits, producing denial of service.\n\n## Proof of Concept\n\n1. Start C2 server with active operator session(s) in a lab environment.\n2. Generate rapid operator session churn (connect/disconnect loops).\n3. Simultaneously drive agent message tunnel traffic and/or file transfer activity.\n4. Observe crash signature in logs: `fatal error: concurrent map read and map write`.\n5. Optional: run with race detector in dev build to confirm race locations.\n\n## Impact\n\n- C2 service interruption due to process panic/crash.\n- Operational instability under load or deliberate churn.\n- Repeated crash-restart cycles can degrade command reliability and incident response workflows.",
  "id": "GHSA-f5p9-j34q-pwcc",
  "modified": "2026-02-19T21:56:27Z",
  "published": "2026-02-17T21:27:58Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jm33-m0/emp3r0r/security/advisories/GHSA-f5p9-j34q-pwcc"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26201"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jm33-m0/emp3r0r/commit/ea4d074f081dac6293f3aec38f01def5f08d5af5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jm33-m0/emp3r0r"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jm33-m0/emp3r0r/releases/tag/v3.21.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "emp3r0r Affected by Concurrent Map Access DoS (panic/crash)"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.