CVE-2026-61554

CVE-2026-61554 is a high-severity uncontrolled resource consumption vulnerability in github.com/jm33-m0/emp3r0r/core (go), affecting versions < 0.0.0-20260531142011-aed3d81641ab. It is fixed in 0.0.0-20260531142011-aed3d81641ab.

Does this CVE actually affect you?

Kodem shows which CVEs are reachable and running in your applications, so you fix what's exploitable, not just what's listed.

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Runtime intelligence, not another scanner.

Summary

emp3r0r has an unauthenticated HTTP Polling DoS

The http_poll C2 transport accepts attacker-controlled HTTP polling sessions before CBOR MsgAuth authentication is completed. A remote unauthenticated attacker can create arbitrary polling sessions and send request bodies that are forwarded into the C2 dispatch path. This can consume server resources and trigger pre-auth C2 processing.

Details

The plain HTTP C2 server starts the HTTP polling listener and forwards requests into HandleHTTPServerSession:

// core/internal/cc/server/c2_http_server.go
mux.HandleFunc(c2Path, func(w http.ResponseWriter, req *http.Request) {
    stream, err := transport.HandleHTTPServerSession(w, req, &live.RuntimeConfig.MalleableC2)
    ...
    if stream != nil {
        go cborStreamAccept(transport.NewStreamTransport(stream, req.RemoteAddr))
    }
})

The HTTP polling handler accepts an attacker-supplied sessionID and init=1 cookie, then creates and stores a server-side stream before authentication:

// core/internal/transport/c2channel_http.go
if isInit {
    stream = newHTTPServerStream(sessionID)
    w.WriteHeader(http.StatusOK)
    return stream, nil
}

POST bodies for that unauthenticated session are read and queued before CBOR authentication rejects them:

// core/internal/transport/c2channel_http.go
case http.MethodPost:
    data, err := io.ReadAll(req.Body)
    if err == nil && len(data) > 0 {
        select {
        case stream.readCh <- data:
            w.WriteHeader(http.StatusOK)
        ...
        }
    }

Authentication only happens later in the C2 dispatch layer:

// core/internal/cc/server/dispatcher.go
secureConn := transport.NewSecureConn(t)
...
n, err := secureConn.Read(authFrame)

PoC

  1. Start the C2 server in a lab environment with the HTTP polling transport exposed, for example with --http-port 12345.
  2. Send an unauthenticated HTTP POST to the default polling path /api/v1/telemetry with a random sessionID cookie and the init=1 cookie value.
  3. Send a second unauthenticated HTTP POST to /api/v1/telemetry using the same sessionID, with a request body containing repeated A bytes.
  4. Observe that both unauthenticated requests return HTTP 200.
  5. Observe the C2 server log showing attacker-controlled bytes reaching the encrypted C2 frame parser, for example: read: invalid encrypted chunk length: 1094795585.
  6. 1094795585 is 0x41414141, which corresponds to AAAA, confirming unauthenticated request body data reached cborProtocolDispatch before CBOR MsgAuth authentication.
  7. Repeat the request sequence concurrently to increase server resource usage and log volume.

Impact

  • Remote unauthenticated attackers can create arbitrary HTTP polling sessions.
  • Attacker-controlled request bodies reach pre-auth C2 dispatch handling.
  • Repeated requests can consume server memory, goroutines, request handling capacity, and log volume.
  • C2 service availability and operator reliability may be degraded under sustained traffic.

Crafted input forces the application to consume excessive CPU, memory, or other resources, degrading or denying service. Typical impact: denial of service.

CVE-2026-61554 has a CVSS score of 7.5 (High). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.0.0-20260531142011-aed3d81641ab); upgrading removes the vulnerable code path.

Affected versions

github.com/jm33-m0/emp3r0r/core (< 0.0.0-20260531142011-aed3d81641ab)

Security releases

github.com/jm33-m0/emp3r0r/core → 0.0.0-20260531142011-aed3d81641ab (go)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environmentNew to Kodem? Get a demo →

Remediation advice

  • Require authentication before creating long-lived HTTP polling sessions.
  • Do not forward request bodies into the C2 stream before validation.
  • Add strict request body limits.

Frequently Asked Questions

  1. What is CVE-2026-61554? CVE-2026-61554 is a high-severity uncontrolled resource consumption vulnerability in github.com/jm33-m0/emp3r0r/core (go), affecting versions < 0.0.0-20260531142011-aed3d81641ab. It is fixed in 0.0.0-20260531142011-aed3d81641ab. Crafted input forces the application to consume excessive CPU, memory, or other resources, degrading or denying service.
  2. How severe is CVE-2026-61554? CVE-2026-61554 has a CVSS score of 7.5 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
  3. Which versions of github.com/jm33-m0/emp3r0r/core are affected by CVE-2026-61554? github.com/jm33-m0/emp3r0r/core (go) versions < 0.0.0-20260531142011-aed3d81641ab is affected.
  4. Is there a fix for CVE-2026-61554? Yes. CVE-2026-61554 is fixed in 0.0.0-20260531142011-aed3d81641ab. Upgrade to this version or later.
  5. Is CVE-2026-61554 exploitable, and should I be worried? Whether CVE-2026-61554 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
  6. What actually determines whether CVE-2026-61554 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
  7. How do I fix CVE-2026-61554? Upgrade github.com/jm33-m0/emp3r0r/core to 0.0.0-20260531142011-aed3d81641ab or later.

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo