CVE-2026-45090: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in hahwul dalfox
CVE-2026-45090 is a race condition vulnerability in hahwul dalfox versions prior to 2.13.0. The issue arises because two sequential worker stages write to the same results channel, which is closed after the first stage, causing the second stage to write to a closed channel. This triggers a Go runtime panic that crashes the dalfox process. In server mode, this crash can be remotely triggered by unauthenticated callers via the REST API if the default configuration is used without an API key and the attacker supplies POST-body data that is reflected by the target. The vulnerability is fixed in version 2.13.0.
AI Analysis
Technical Summary
Dalfox, an open-source XSS scanner, had a concurrency flaw in its ParameterAnalysis component before version 2.13.0. Two sequential worker stages write to the same results channel; the channel is closed after the first stage, but the second stage still attempts to write to it, causing a runtime panic and process crash. This can be remotely triggered in server mode without authentication if the attacker supplies POST data and the target reflects parameters. This is a race condition and improper synchronization issue (CWE-362) leading to denial of service by crashing the scanner process. The issue is resolved in dalfox 2.13.0.
Potential Impact
The vulnerability causes a denial of service by crashing the dalfox process due to a runtime panic when writing to a closed channel. In server mode, unauthenticated remote attackers can trigger this crash via the REST API if the default configuration is used without an API key and the target reflects supplied POST parameters. There is no impact on confidentiality or integrity, but availability of the dalfox scanning service is affected.
Mitigation Recommendations
This vulnerability is fixed in dalfox version 2.13.0. Users should upgrade to version 2.13.0 or later to remediate this issue. Until upgrading, avoid running dalfox in server mode with the default configuration lacking an API key, or restrict access to the REST API to trusted users only. Patch status is not explicitly stated in vendor advisory content, but the fix is included in version 2.13.0.
CVE-2026-45090: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in hahwul dalfox
Description
CVE-2026-45090 is a race condition vulnerability in hahwul dalfox versions prior to 2.13.0. The issue arises because two sequential worker stages write to the same results channel, which is closed after the first stage, causing the second stage to write to a closed channel. This triggers a Go runtime panic that crashes the dalfox process. In server mode, this crash can be remotely triggered by unauthenticated callers via the REST API if the default configuration is used without an API key and the attacker supplies POST-body data that is reflected by the target. The vulnerability is fixed in version 2.13.0.
CVSS v3.1
Score 7.5high
Affected software
pkg:golang/github.com/hahwul/dalfoxRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Dalfox, an open-source XSS scanner, had a concurrency flaw in its ParameterAnalysis component before version 2.13.0. Two sequential worker stages write to the same results channel; the channel is closed after the first stage, but the second stage still attempts to write to it, causing a runtime panic and process crash. This can be remotely triggered in server mode without authentication if the attacker supplies POST data and the target reflects parameters. This is a race condition and improper synchronization issue (CWE-362) leading to denial of service by crashing the scanner process. The issue is resolved in dalfox 2.13.0.
Potential Impact
The vulnerability causes a denial of service by crashing the dalfox process due to a runtime panic when writing to a closed channel. In server mode, unauthenticated remote attackers can trigger this crash via the REST API if the default configuration is used without an API key and the target reflects supplied POST parameters. There is no impact on confidentiality or integrity, but availability of the dalfox scanning service is affected.
Mitigation Recommendations
This vulnerability is fixed in dalfox version 2.13.0. Users should upgrade to version 2.13.0 or later to remediate this issue. Until upgrading, avoid running dalfox in server mode with the default configuration lacking an API key, or restrict access to the REST API to trusted users only. Patch status is not explicitly stated in vendor advisory content, but the fix is included in version 2.13.0.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-08T19:27:26.698Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a172e7fe29bf47b50d78ab4
Added to database: 05/27/2026, 17:48:47 UTC
Last enriched: 06/03/2026, 20:49:33 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 98
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.