CVE-2026-61554 emp3r0r has an unauthenticated HTTP Polling DoS
Unauthenticated attackers can create arbitrary polling sessions in emp3r0r C2 servers, consuming resources and causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-61554?
CVE-2026-61554 is a high-severity denial of service vulnerability in jm33-m0 emp3r0r, published on 15 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
emp3r0r is a C2 designed by Linux users for Linux environments. Prior to version 4.2.5, the `http_poll` C2 transport accepts attacker-controlled HTTP polling sessions before CBOR `MsgAuth` authentication is completed. A remote unauthenticated attacker can create arbitrary polling sessions and send request bodies that are forwarded into the C2 dispatch path. This can consume server resources and trigger pre-auth C2 processing. Version 4.2.5 patches the issue.
Weakness: CWE-400
Which versions are affected by CVE-2026-61554?
3 open source packages ship an affected version, including github.com/jm33-m0/emp3r0r/core.
| Package | Affected | Fixed in |
|---|---|---|
github.com/jm33-m0/emp3r0r/core Go | All versions | 0.0.0-20260531142011-aed3d81641ab |
github.com/jm33-m0/emp3r0r/core Go | All versions | 0.0.0-20260531142011-aed3d81641ab |
github.com/jm33-m0/emp3r0r/core Go | All versions | 0.0.0-20260531142011-aed3d81641ab |
How do I fix CVE-2026-61554?
Upgrade github.com/jm33-m0/emp3r0r/core to 0.0.0-20260531142011-aed3d81641ab or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-61554 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-61554 exists.
Sources
Also known as GHSA-4595-rvpx-4q34, GO-2026-6487.