CVE-2026-61554

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-09-15

Last updated on: 2026-09-30

Assigner: GitHub, Inc.

Description

emp3r0r is a C2 designed by Linux users for Linux environments. Prior to version 4.2.5, the `http_poll` C2 transport accepts attacker-controlled HTTP polling sessions before CBOR `MsgAuth` authentication is completed. A remote unauthenticated attacker can create arbitrary polling sessions and send request bodies that are forwarded into the C2 dispatch path. This can consume server resources and trigger pre-auth C2 processing. Version 4.2.5 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-30

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-05

NVD

CVE-2026-61554

EUVD

EUVD-2026-79996

Affected Vendors & Products

Vendor	Product	Version / Range
jm33-m0	emp3r0r	< 4.2.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This is a pre-authentication resource exhaustion vulnerability in emp3r0r, a Linux C2 framework. Before version 4.2.5, the http_poll transport allows unauthenticated attackers to create arbitrary polling sessions and send request bodies that are processed by the C2 server even before CBOR MsgAuth authentication completes. This can consume server resources and trigger pre-auth processing.

Impact Analysis

An unauthenticated remote attacker could exploit this to consume server resources, potentially causing denial of service by overloading the C2 server with fake polling sessions and requests. This may degrade performance or crash the server.

Mitigation Strategies

Update emp3r0r to version 4.2.5 or later to patch the vulnerability. Disable or restrict access to the http_poll transport until the update is applied.

Hi! I’m here to help you understand CVE-2026-61554. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70