{"schema_version":"1.7.3","id":"GHSA-f5p9-j34q-pwcc","published":"2026-02-17T21:27:58Z","modified":"2026-02-23T19:41:15.897023Z","aliases":["CVE-2026-26201","GO-2026-4504"],"summary":"emp3r0r Affected by Concurrent Map Access DoS (panic/crash)","details":"## Summary\n\nMultiple shared maps are accessed without consistent synchronization across goroutines. Under concurrent activity, Go runtime can trigger `fatal error: concurrent map read and map write`, causing C2 process crash (availability loss).\n\n## Vulnerable Component(with code examples)\n\nOperator relay map had mixed access patterns (iteration and mutation without a single lock policy):\n\n```go\n// vulnerable pattern (operator session map)\nfor sessionID, op := range OPERATORS { // iteration path\n    ...\n}\n\n// concurrent mutation path elsewhere\nOPERATORS[operatorSession] = &operator_t{...}\ndelete(OPERATORS, operatorSession)\n```\n\nPort-forwarding session map had read/write paths guarded inconsistently:\n\n```go\n// vulnerable pattern (port forward map)\nif sess, ok := PortFwds[id]; ok { // read path\n    ...\n}\n\nPortFwds[id] = newSession // write path\ndelete(PortFwds, id)      // delete path\n```\n\nFTP stream map similarly mixed concurrent iteration with mutation:\n\n```go\n// vulnerable pattern (FTP stream map)\nfor token, stream := range FTPStreams { // iteration path\n    ...\n}\n\nFTPStreams[token] = stream // write path\ndelete(FTPStreams, token)  // delete path\n```\n\n## Attack Vector\n\n1. Attacker (or stress traffic in authenticated flows) triggers high concurrency in normal control paths.\n2. Operator sessions connect/disconnect while message forwarding and file-transfer workflows are active.\n3. Concurrent read/write hits shared maps.\n4. Go runtime panics with concurrent map read/write error.\n5. C2 component exits, producing denial of service.\n\n## Proof of Concept\n\n1. Start C2 server with active operator session(s) in a lab environment.\n2. Generate rapid operator session churn (connect/disconnect loops).\n3. Simultaneously drive agent message tunnel traffic and/or file transfer activity.\n4. Observe crash signature in logs: `fatal error: concurrent map read and map write`.\n5. Optional: run with race detector in dev build to confirm race locations.\n\n## Impact\n\n- C2 service interruption due to process panic/crash.\n- Operational instability under load or deliberate churn.\n- Repeated crash-restart cycles can degrade command reliability and incident response workflows.","affected":[{"package":{"name":"github.com/jm33-m0/emp3r0r/core","ecosystem":"Go","purl":"pkg:golang/github.com/jm33-m0/emp3r0r/core"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20260212232424-ea4d074f081d"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-f5p9-j34q-pwcc/GHSA-f5p9-j34q-pwcc.json"}}],"references":[{"type":"WEB","url":"https://github.com/jm33-m0/emp3r0r/security/advisories/GHSA-f5p9-j34q-pwcc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26201"},{"type":"WEB","url":"https://github.com/jm33-m0/emp3r0r/commit/ea4d074f081dac6293f3aec38f01def5f08d5af5"},{"type":"PACKAGE","url":"https://github.com/jm33-m0/emp3r0r"},{"type":"WEB","url":"https://github.com/jm33-m0/emp3r0r/releases/tag/v3.21.2"}],"database_specific":{"cwe_ids":["CWE-362","CWE-663"],"github_reviewed":true,"github_reviewed_at":"2026-02-17T21:27:58Z","nvd_published_at":"2026-02-19T20:25:42Z","severity":"HIGH"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}]}