CVE-2026-61554

Name of the Vulnerable Software and Affected Versions emp3r0r versions prior to 4.2.5

Description The http poll C2 transport accepts attacker-controlled HTTP polling sessions before CBOR MsgAuth authentication is completed. A remote unauthenticated attacker can create arbitrary polling sessions and send request bodies that are forwarded into the C2 dispatch path. This process can consume server resources, such as memory, goroutines, and request handling capacity, and trigger pre-auth C2 processing, potentially degrading service availability. The issue occurs when the server accepts a sessionID and init=1 cookie to create a server-side stream before authentication is verified in the C2 dispatch layer.

Recommendations Update to version 4.2.5.