{"id":"CVE-2026-26201","aliases":["GHSA-f5p9-j34q-pwcc","GO-2026-4504"],"url":"https://o3.security/vulnerability/CVE-2026-26201","summary":"emp3r0r Affected by Concurrent Map Access DoS (panic/crash)","details":"## Summary\n\nMultiple shared maps are accessed without consistent synchronization across goroutines. Under concurrent activity, Go runtime can trigger `fatal error: concurrent map read and map write`, causing C2 process crash (availability loss).\n\n## Vulnerable Component(with code examples)\n\nOperator relay map had mixed access patterns (iteration and mutation without a single lock policy):\n\n```go\n// vulnerable pattern (operator session map)\nfor sessionID, op := range OPERATORS { // iteration path\n    ...\n}\n\n// concurrent mutation path elsewhere\nOPERATORS[operatorSession] = &operator_t{...}\ndelete(OPERATORS, operatorSession)\n```\n\nPort-forwarding session map had read/write paths guarded inconsistently:\n\n```go\n// vulnerable pattern (port forward map)\nif sess, ok := PortFwds[id]; ok { // read path\n    ...\n}\n\nPortFwds[id] = newSession // write path\ndelete(PortFwds, id)      // delete path\n```\n\nFTP stream map similarly mixed concurrent iteration with mutation:\n\n```go\n// vulnerable pattern (FTP stream map)\nfor token, stream := range FTPStreams { // iteration path\n    ...\n}\n\nFTPStreams[token] = stream // write path\ndelete(FTPStreams, token)  // delete path\n```\n\n## Attack Vector\n\n1. Attacker (or stress traffic in authenticated flows) triggers high concurrency in normal control paths.\n2. Operator sessions connect/disconnect while message forwarding and file-transfer workflows are active.\n3. Concurrent read/write hits shared maps.\n4. Go runtime panics with concurrent map read/write error.\n5. C2 component exits, producing denial of service.\n\n## Proof of Concept\n\n1. Start C2 server with active operator session(s) in a lab environment.\n2. Generate rapid operator session churn (connect/disconnect loops).\n3. Simultaneously drive agent message tunnel traffic and/or file transfer activity.\n4. Observe crash signature in logs: `fatal error: concurrent map read and map write`.\n5. Optional: run with race detector in dev build to confirm race locations.\n\n## Impact\n\n- C2 service interruption due to process panic/crash.\n- Operational instability under load or deliberate churn.\n- Repeated crash-restart cycles can degrade command reliability and incident response workflows.","published":"2026-02-19T19:21:05.691Z","modified":"2026-08-12T03:51:09.352254041Z","cvss":null,"epss":{"score":0.00291,"percentile":0.2177,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/jm33-m0/emp3r0r/core","fixedVersion":"0.0.0-20260212232424-ea4d074f081d"}],"fix":{"url":"https://github.com/jm33-m0/emp3r0r/commit/ea4d074f081dac6293f3aec38f01def5f08d5af5","label":"jm33-m0/emp3r0r@ea4d074"},"references":[{"type":"WEB","url":"https://github.com/jm33-m0/emp3r0r/releases/tag/v3.21.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26201.json"},{"type":"ADVISORY","url":"https://github.com/jm33-m0/emp3r0r/security/advisories/GHSA-f5p9-j34q-pwcc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26201"},{"type":"FIX","url":"https://github.com/jm33-m0/emp3r0r/commit/ea4d074f081dac6293f3aec38f01def5f08d5af5"},{"type":"PACKAGE","url":"https://github.com/jm33-m0/emp3r0r"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:09.352254041Z"}}