CVE-2026-45090
Dalfox: Unauthenticated Remote DoS via Closed-Channel Write in `ParameterAnalysis` (server mode)
Description
Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, ParameterAnalysis in pkg/scanning/parameterAnalysis.go runs two sequential worker stages that both write to the same results channel. The channel is correctly closed after the first stage completes (close(results) at line 438), but the second stage — which processes POST-body parameters (dp) — is then launched with the same already-closed channel as its output. When a scanned parameter is reflected, processParams executes results <- paramResult on the closed channel, triggering a Go runtime panic that crashes the entire dalfox process. In server mode, the crash is remotely triggerable by any unauthenticated caller who can reach the REST API, because the default configuration has no API key and the second stage activates whenever options.Data != "" (i.e., the attacker supplies the data field) and the target reflects at least one parameter. This vulnerability is fixed in 2.13.0.
INFO
Published Date :
May 27, 2026, 6:16 p.m.
Last Modified :
Oct. 26, 2026, 11:10 a.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 3.1 | HIGH | MITRE-CVE |
Solution
- Update Dalfox to version 2.13.0 or later.
- Ensure server mode has API key authentication.
- Validate reflected parameters.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-45090.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-45090 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-45090
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-45090 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-45090 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 26, 2026
Action Type Old Value New Value Added Translation Title: dalfox de hahwul, Description: Dalfox es un potente escáner de XSS de código abierto y una utilidad centrada en la automatización. Antes de la versión 2.13.0, ParameterAnalysis en pkg/scanning/parameterAnalysis.go ejecuta dos etapas de trabajador secuenciales que ambas escriben en el mismo canal de resultados. El canal se cierra correctamente después de que la primera etapa se completa (close(results) en la línea 438), pero la segunda etapa -que procesa los parámetros del cuerpo POST (dp)- se lanza entonces con el mismo canal ya cerrado como su salida. Cuando un parámetro escaneado se refleja, processParams ejecuta results <- paramResult en el canal cerrado, lo que desencadena un pánico en tiempo de ejecución de Go que bloquea todo el proceso de dalfox. En modo servidor, el bloqueo puede ser activado remotamente por cualquier llamador no autenticado que pueda alcanzar la API REST, porque la configuración predeterminada no tiene clave de API y la segunda etapa se activa siempre que options.Data != “” (es decir, el atacante suministra el campo de datos) y el objetivo refleja al menos un parámetro. Esta vulnerabilidad se corrige en la versión 2.13.0. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'hahwul', 'product': 'dalfox', 'versions': [{'status': 'affected', 'version': '< 2.13.0'}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-45090', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'yes'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-05-28T15:10:33.002780Z'} -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
May. 28, 2026
Action Type Old Value New Value Added Reference https://github.com/hahwul/dalfox/security/advisories/GHSA-2g4x-fq3j-cgq4 -
New CVE Received by [email protected]
May. 27, 2026
Action Type Old Value New Value Added Description Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, ParameterAnalysis in pkg/scanning/parameterAnalysis.go runs two sequential worker stages that both write to the same results channel. The channel is correctly closed after the first stage completes (close(results) at line 438), but the second stage — which processes POST-body parameters (dp) — is then launched with the same already-closed channel as its output. When a scanned parameter is reflected, processParams executes results <- paramResult on the closed channel, triggering a Go runtime panic that crashes the entire dalfox process. In server mode, the crash is remotely triggerable by any unauthenticated caller who can reach the REST API, because the default configuration has no API key and the second stage activates whenever options.Data != "" (i.e., the attacker supplies the data field) and the target reflects at least one parameter. This vulnerability is fixed in 2.13.0. Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Added CWE CWE-362 Added CWE CWE-404 Added Reference https://github.com/hahwul/dalfox/releases/tag/v2.13.0 Added Reference https://github.com/hahwul/dalfox/security/advisories/GHSA-2g4x-fq3j-cgq4