CVE-2026-61554CWE-400denial-of-service

CVE-2026-61554

High · published September 16, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
52.9
In the wild
Unconfirmed
What it is

emp3r0r is a C2 designed by Linux users for Linux environments. Prior to version 4.2.5, the `http_poll` C2 transport accepts attacker-controlled HTTP polling sessions before CBOR `MsgAuth` authentication is completed. A remote unauthenticated attacker can create arbitrary polling sessions and send request bodies that are forwarded into the C2 dispatch path. This can consume server resources and trigger pre-auth C2 processing. Version 4.2.5 patches the issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00707 · 52.9th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2026-09-16T01:16Z
References (3)
https://github.com/jm33-m0/emp3r0r/releases/tag/v4.2.5 · [email protected]https://github.com/jm33-m0/emp3r0r/security/advisories/GHSA-4595-rvpx-4q34 · [email protected]https://github.com/jm33-m0/emp3r0r/security/advisories/GHSA-4595-rvpx-4q34 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 17 SEP 03:32Z
    EPSS moved — → 1%
    epss
  • 15 SEP 20:48Z
    emp3r0r has an unauthenticated HTTP Polling DoS
    cvelistv5