Vulnerability-Lookup

CVE-2026-61554 (GCVE-0-2026-61554)

Vulnerability from cvelistv5 – Published: 2026-09-15 20:48 – Updated: 2026-09-16 17:59

Title

emp3r0r has an unauthenticated HTTP Polling DoS

Summary

emp3r0r is a C2 designed by Linux users for Linux environments. Prior to version 4.2.5, the `http_poll` C2 transport accepts attacker-controlled HTTP polling sessions before CBOR `MsgAuth` authentication is completed. A remote unauthenticated attacker can create arbitrary polling sessions and send request bodies that are forwarded into the C2 dispatch path. This can consume server resources and trigger pre-auth C2 processing. Version 4.2.5 patches the issue.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-16 17:59 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/jm33-m0/emp3r0r/security/advis…	x_refsource_CONFIRM
https://github.com/jm33-m0/emp3r0r/releases/tag/v4.2.5	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
jm33-m0	emp3r0r	Affected: < 4.2.5	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-61554",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T17:59:27.422568Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T17:59:54.763Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/jm33-m0/emp3r0r/security/advisories/GHSA-4595-rvpx-4q34"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "emp3r0r",
          "vendor": "jm33-m0",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.2.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "emp3r0r is a C2 designed by Linux users for Linux environments. Prior to version 4.2.5, the `http_poll` C2 transport accepts attacker-controlled HTTP polling sessions before CBOR `MsgAuth` authentication is completed. A remote unauthenticated attacker can create arbitrary polling sessions and send request bodies that are forwarded into the C2 dispatch path. This can consume server resources and trigger pre-auth C2 processing. Version 4.2.5 patches the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T20:48:05.156Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jm33-m0/emp3r0r/security/advisories/GHSA-4595-rvpx-4q34",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jm33-m0/emp3r0r/security/advisories/GHSA-4595-rvpx-4q34"
        },
        {
          "name": "https://github.com/jm33-m0/emp3r0r/releases/tag/v4.2.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jm33-m0/emp3r0r/releases/tag/v4.2.5"
        }
      ],
      "source": {
        "advisory": "GHSA-4595-rvpx-4q34",
        "discovery": "UNKNOWN"
      },
      "title": "emp3r0r has an unauthenticated HTTP Polling DoS"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-61554",
    "datePublished": "2026-09-15T20:48:05.156Z",
    "dateReserved": "2026-07-10T16:48:39.923Z",
    "dateUpdated": "2026-09-16T17:59:54.763Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-61554",
      "date": "2026-09-17",
      "epss": "0.00549",
      "percentile": "0.44652"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "emp3r0r",
                "vendor": "jm33-m0",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 4.2.5"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "emp3r0r is a C2 designed by Linux users for Linux environments. Prior to version 4.2.5, the `http_poll` C2 transport accepts attacker-controlled HTTP polling sessions before CBOR `MsgAuth` authentication is completed. A remote unauthenticated attacker can create arbitrary polling sessions and send request bodies that are forwarded into the C2 dispatch path. This can consume server resources and trigger pre-auth C2 processing. Version 4.2.5 patches the issue."
          }
        ],
        "id": "CVE-2026-61554",
        "lastModified": "2026-09-16T19:17:22.020",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-61554",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T17:59:27.422568Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-15T21:16:41.223",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/jm33-m0/emp3r0r/releases/tag/v4.2.5"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/jm33-m0/emp3r0r/security/advisories/GHSA-4595-rvpx-4q34"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/jm33-m0/emp3r0r/security/advisories/GHSA-4595-rvpx-4q34"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Received",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-400"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-61554",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-16T17:59:27.422568Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-16T17:59:46.663Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/jm33-m0/emp3r0r/security/advisories/GHSA-4595-rvpx-4q34"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "emp3r0r",
              "vendor": "jm33-m0",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 4.2.5"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "emp3r0r is a C2 designed by Linux users for Linux environments. Prior to version 4.2.5, the `http_poll` C2 transport accepts attacker-controlled HTTP polling sessions before CBOR `MsgAuth` authentication is completed. A remote unauthenticated attacker can create arbitrary polling sessions and send request bodies that are forwarded into the C2 dispatch path. This can consume server resources and trigger pre-auth C2 processing. Version 4.2.5 patches the issue."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-400",
                  "description": "CWE-400: Uncontrolled Resource Consumption",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-15T20:48:05.156Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/jm33-m0/emp3r0r/security/advisories/GHSA-4595-rvpx-4q34",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/jm33-m0/emp3r0r/security/advisories/GHSA-4595-rvpx-4q34"
            },
            {
              "name": "https://github.com/jm33-m0/emp3r0r/releases/tag/v4.2.5",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/jm33-m0/emp3r0r/releases/tag/v4.2.5"
            }
          ],
          "source": {
            "advisory": "GHSA-4595-rvpx-4q34",
            "discovery": "UNKNOWN"
          },
          "title": "emp3r0r has an unauthenticated HTTP Polling DoS"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-61554",
        "datePublished": "2026-09-15T20:48:05.156Z",
        "dateReserved": "2026-07-10T16:48:39.923Z",
        "dateUpdated": "2026-09-16T17:59:54.763Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-61554

Vulnerability from fkie_nvd - Published: 2026-09-15 21:16 - Updated: 2026-09-16 19:17

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/jm33-m0/emp3r0r/releases/tag/v4.2.5
	security-advisories@github.com	https://github.com/jm33-m0/emp3r0r/security/advisories/GHSA-4595-rvpx-4q34
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/jm33-m0/emp3r0r/security/advisories/GHSA-4595-rvpx-4q34

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "emp3r0r",
          "vendor": "jm33-m0",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.2.5"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "emp3r0r is a C2 designed by Linux users for Linux environments. Prior to version 4.2.5, the `http_poll` C2 transport accepts attacker-controlled HTTP polling sessions before CBOR `MsgAuth` authentication is completed. A remote unauthenticated attacker can create arbitrary polling sessions and send request bodies that are forwarded into the C2 dispatch path. This can consume server resources and trigger pre-auth C2 processing. Version 4.2.5 patches the issue."
    }
  ],
  "id": "CVE-2026-61554",
  "lastModified": "2026-09-16T19:17:22.020",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-61554",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-16T17:59:27.422568Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-15T21:16:41.223",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jm33-m0/emp3r0r/releases/tag/v4.2.5"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jm33-m0/emp3r0r/security/advisories/GHSA-4595-rvpx-4q34"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/jm33-m0/emp3r0r/security/advisories/GHSA-4595-rvpx-4q34"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-4595-RVPX-4Q34

Vulnerability from github – Published: 2026-09-15 20:47 – Updated: 2026-09-15 20:47

Summary

emp3r0r has an unauthenticated HTTP Polling DoS

Details

Summary

The http_poll C2 transport accepts attacker-controlled HTTP polling sessions before CBOR MsgAuth authentication is completed. A remote unauthenticated attacker can create arbitrary polling sessions and send request bodies that are forwarded into the C2 dispatch path. This can consume server resources and trigger pre-auth C2 processing.

Details

The plain HTTP C2 server starts the HTTP polling listener and forwards requests into HandleHTTPServerSession:

// core/internal/cc/server/c2_http_server.go
mux.HandleFunc(c2Path, func(w http.ResponseWriter, req *http.Request) {
    stream, err := transport.HandleHTTPServerSession(w, req, &live.RuntimeConfig.MalleableC2)
    ...
    if stream != nil {
        go cborStreamAccept(transport.NewStreamTransport(stream, req.RemoteAddr))
    }
})

The HTTP polling handler accepts an attacker-supplied sessionID and init=1 cookie, then creates and stores a server-side stream before authentication:

// core/internal/transport/c2channel_http.go
if isInit {
    stream = newHTTPServerStream(sessionID)
    w.WriteHeader(http.StatusOK)
    return stream, nil
}

POST bodies for that unauthenticated session are read and queued before CBOR authentication rejects them:

// core/internal/transport/c2channel_http.go
case http.MethodPost:
    data, err := io.ReadAll(req.Body)
    if err == nil && len(data) > 0 {
        select {
        case stream.readCh <- data:
            w.WriteHeader(http.StatusOK)
        ...
        }
    }

Authentication only happens later in the C2 dispatch layer:

// core/internal/cc/server/dispatcher.go
secureConn := transport.NewSecureConn(t)
...
n, err := secureConn.Read(authFrame)

PoC

Start the C2 server in a lab environment with the HTTP polling transport exposed, for example with --http-port 12345.
Send an unauthenticated HTTP POST to the default polling path /api/v1/telemetry with a random sessionID cookie and the init=1 cookie value.
Send a second unauthenticated HTTP POST to /api/v1/telemetry using the same sessionID, with a request body containing repeated A bytes.
Observe that both unauthenticated requests return HTTP 200.
Observe the C2 server log showing attacker-controlled bytes reaching the encrypted C2 frame parser, for example: read: invalid encrypted chunk length: 1094795585.
1094795585 is 0x41414141, which corresponds to AAAA, confirming unauthenticated request body data reached cborProtocolDispatch before CBOR MsgAuth authentication.
Repeat the request sequence concurrently to increase server resource usage and log volume.

Impact

Remote unauthenticated attackers can create arbitrary HTTP polling sessions.
Attacker-controlled request bodies reach pre-auth C2 dispatch handling.
Repeated requests can consume server memory, goroutines, request handling capacity, and log volume.
C2 service availability and operator reliability may be degraded under sustained traffic.

Remediation

Require authentication before creating long-lived HTTP polling sessions.
Do not forward request bodies into the C2 stream before validation.
Add strict request body limits.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/jm33-m0/emp3r0r/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20260531142011-aed3d81641ab"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-61554"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-15T20:47:17Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\nThe `http_poll` C2 transport accepts attacker-controlled HTTP polling sessions before CBOR `MsgAuth` authentication is completed. A remote unauthenticated attacker can create arbitrary polling sessions and send request bodies that are forwarded into the C2 dispatch path. This can consume server resources and trigger pre-auth C2 processing.\n\n### Details\nThe plain HTTP C2 server starts the HTTP polling listener and forwards requests into `HandleHTTPServerSession`:\n```go\n// core/internal/cc/server/c2_http_server.go\nmux.HandleFunc(c2Path, func(w http.ResponseWriter, req *http.Request) {\n    stream, err := transport.HandleHTTPServerSession(w, req, \u0026live.RuntimeConfig.MalleableC2)\n    ...\n    if stream != nil {\n        go cborStreamAccept(transport.NewStreamTransport(stream, req.RemoteAddr))\n    }\n})\n```\nThe HTTP polling handler accepts an attacker-supplied `sessionID` and `init=1` cookie, then creates and stores a server-side stream before authentication:\n\n```go\n// core/internal/transport/c2channel_http.go\nif isInit {\n    stream = newHTTPServerStream(sessionID)\n    w.WriteHeader(http.StatusOK)\n    return stream, nil\n}\n```\nPOST bodies for that unauthenticated session are read and queued before CBOR authentication rejects them:\n```go\n// core/internal/transport/c2channel_http.go\ncase http.MethodPost:\n    data, err := io.ReadAll(req.Body)\n    if err == nil \u0026\u0026 len(data) \u003e 0 {\n        select {\n        case stream.readCh \u003c- data:\n            w.WriteHeader(http.StatusOK)\n        ...\n        }\n    }\n```\nAuthentication only happens later in the C2 dispatch layer:\n```go\n// core/internal/cc/server/dispatcher.go\nsecureConn := transport.NewSecureConn(t)\n...\nn, err := secureConn.Read(authFrame)\n```\n\n### PoC\n1. Start the C2 server in a lab environment with the HTTP polling transport exposed, for example with `--http-port 12345`.\n2. Send an unauthenticated HTTP POST to the default polling path `/api/v1/telemetry` with a random `sessionID` cookie and the `init=1` cookie value.\n3. Send a second unauthenticated HTTP POST to `/api/v1/telemetry` using the same `sessionID`, with a request body containing repeated `A` bytes.\n4. Observe that both unauthenticated requests return HTTP `200`.\n5. Observe the C2 server log showing attacker-controlled bytes reaching the encrypted C2 frame parser, for example: `read: invalid encrypted chunk length: 1094795585`.\n6. `1094795585` is `0x41414141`, which corresponds to `AAAA`, confirming unauthenticated request body data reached `cborProtocolDispatch` before CBOR `MsgAuth` authentication.\n7. Repeat the request sequence concurrently to increase server resource usage and log volume.\n\n### Impact\n- Remote unauthenticated attackers can create arbitrary HTTP polling sessions.\n- Attacker-controlled request bodies reach pre-auth C2 dispatch handling.\n- Repeated requests can consume server memory, goroutines, request handling capacity, and log volume.\n- C2 service availability and operator reliability may be degraded under sustained traffic.\n\n### Remediation\n- Require authentication before creating long-lived HTTP polling sessions.\n- Do not forward request bodies into the C2 stream before validation.\n- Add strict request body limits.",
  "id": "GHSA-4595-rvpx-4q34",
  "modified": "2026-09-15T20:47:17Z",
  "published": "2026-09-15T20:47:17Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jm33-m0/emp3r0r/security/advisories/GHSA-4595-rvpx-4q34"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jm33-m0/emp3r0r"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jm33-m0/emp3r0r/releases/tag/v4.2.5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "emp3r0r has an unauthenticated HTTP Polling DoS"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-61554 (GCVE-0-2026-61554)

FKIE_CVE-2026-61554

GHSA-4595-RVPX-4Q34

Summary

Details

PoC

Impact

Remediation

Tags

Sightings

Nomenclature

Related by attack behaviour