CVE-2026-45090
published 2026-05-27CVE-2026-45090: Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, ParameterAnalysis in pkg/scanning/parameterAnalysis.go runs…
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.23%
13.8th percentile
Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, ParameterAnalysis in pkg/scanning/parameterAnalysis.go runs two sequential worker stages that both write to the same results channel. The channel is correctly closed after the first stage completes (close(results) at line 438), but the second stage — which processes POST-body parameters (dp) — is then launched with the same already-closed channel as its output. When a scanned parameter is reflected, processParams executes results <- paramResult on the closed channel, triggering a Go runtime panic that crashes the entire dalfox process. In server mode, the crash is remotely triggerable by any unauthenticated caller who can reach the REST API, because the default configuration has no API key and the second stage activates whenever options.Data != "" (i.e., the attacker supplies the data field) and the target reflects at least one parameter. This vulnerability is fixed in 2.13.0.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | hahwul_dalfox_v2 | >= 0 < 2.13.0 | 2.13.0 |
| hahwul | dalfox | < 2.13.0 | 2.13.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
hahwul dalfox up to 2.12.x REST API parameterAnalysis.go race condition (GHSA-2g4x-fq3j-cgq4)
vuldb·2026-05-27·CVSS 7.5
CVE-2026-45090 [HIGH] hahwul dalfox up to 2.12.x REST API parameterAnalysis.go race condition (GHSA-2g4x-fq3j-cgq4)
A vulnerability was found in hahwul dalfox up to 2.12.x. It has been declared as problematic. This affects an unknown function of the file pkg/scanning/parameterAnalysis.go of the component REST API. Executing a manipulation can lead to race condition.
The identification of this vulnerability is CVE-2026-45090. The attack may be launched remotely. There is no exploit available.
It is recommended to upgrade the affected component.
GHSA
Dalfox has an Unauthenticated Remote DoS via Closed-Channel Write in `ParameterAnalysis` (server mode)
ghsa·2026-05-12
CVE-2026-45090 [HIGH] CWE-362 Dalfox has an Unauthenticated Remote DoS via Closed-Channel Write in `ParameterAnalysis` (server mode)
Dalfox has an Unauthenticated Remote DoS via Closed-Channel Write in `ParameterAnalysis` (server mode)
## Summary
`ParameterAnalysis` in `pkg/scanning/parameterAnalysis.go` runs two sequential worker stages that both write to the same `results` channel. The channel is correctly closed after the first stage completes (`close(results)` at line 438), but the second stage — which processes POST-body parameters (`dp`) — is then launched with the same already-closed channel as its output. When a scanned parameter is reflected, `processParams` executes `results {v}'.encode()
self.send_response(200)
self.send_header('Content-Type', 'text/html')
self.send_header('Content-Length', str(len(out)))
self.end_headers()
self.wfile.write(out)
def do_GET(self): self._h()
def do_POST(self): self._h()
def l
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-05-27
Published