Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Go github.com/jm33-m0/emp3r0r/core < 0.0.0-20260531142011-aed3d81641ab
Fixed in
0.0.0-20260531142011-aed3d81641ab· Vendor fix available
Issue
The httppoll C2 transport accepts attacker-controlled HTTP polling sessions before CBOR MsgAuth authentication is completed. A remote unauthenticated attacker can create arbitrary polling sessions and send request bodies that are forwarded into the C2 dispatch path. This can consume server resources and trigger pre-auth C2 processing. Details The plain HTTP C2 server starts the HTTP polling listener and forwards requests into HandleHTTPServerSession: The HTTP polling handler accepts an attacker-supplied sessionID and init=1 cookie, then creates and stores a server-side stream before authentication: POST bodies for that unauthenticated session are read and queued before CBOR authentication rejects them: Authentication only happens later in the C2 dispatch layer: PoC 1. Start the C2 server in a lab environment with the HTTP polling transport exposed, for example with --http-port 12345. 2. Send an unauthenticated HTTP POST to the default polling path /api/v1/telemetry with a…
Recommended action: Upgrade to 0.0.0-20260531142011-aed3d81641ab (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/jm33-m0/emp3r0r/core < 0.0.0-20260212232424-ea4d074f081d
Fixed in
0.0.0-20260212232424-ea4d074f081d· Vendor fix available
Issue
Multiple shared maps are accessed without consistent synchronization across goroutines. Under concurrent activity, Go runtime can trigger fatal error: concurrent map read and map write, causing C2 process crash (availability loss). Vulnerable Component(with code examples) Operator relay map had mixed access patterns (iteration and mutation without a single lock policy): Port-forwarding session map had read/write paths guarded inconsistently: FTP stream map similarly mixed concurrent iteration with mutation: Attack Vector 1. Attacker (or stress traffic in authenticated flows) triggers high concurrency in normal control paths. 2. Operator sessions connect/disconnect while message forwarding and file-transfer workflows are active. 3. Concurrent read/write hits shared maps. 4. Go runtime panics with concurrent map read/write error. 5. C2 component exits, producing denial of service. Proof of Concept 1. Start C2 server with active operator session(s) in a lab environment. 2.…
Recommended action: Upgrade to 0.0.0-20260212232424-ea4d074f081d (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.