CVE-2026-61554: emp3r0r has an unauthenticated HTTP Polling DoS
emp3r0r is a C2 designed by Linux users for Linux environments. Prior to version 4.2.5, the httppoll C2 transport accepts attacker-controlled HTTP polling sessions before CBOR MsgAuth authentication is completed. A remote unauthenticated attacker can create arbitrary polling sessions and send request bodies that are forwarded into the C2 dispatch path. This can consume server resources and trigger pre-auth C2 processing. Version 4.2.5 patches the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
emp3r0rto a version that resolves this vulnerability.Fixed in 4.2.5
Event History
Frequently Asked Questions
Which deployments are exposed?
emp3r0r deployments using the http_poll C2 transport are exposed if they run a version earlier than 4.2.5 and are reachable by a remote attacker over HTTP. The issue does not require authentication or user interaction.
What can an attacker do without valid C2 authentication?
An attacker can create arbitrary HTTP polling sessions and submit request bodies before CBOR MsgAuth authentication completes. Those bodies are forwarded to the C2 dispatch path, allowing resource consumption and pre-auth C2 processing that can cause denial of service.
What is the remediation?
Upgrade emp3r0r to version 4.2.5, which patches the issue. If upgrading cannot happen immediately, restrict remote HTTP access to the affected http_poll transport to limit unauthenticated attackers' ability to create polling sessions.