CVE-2026-45090 Details
Description
Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, ParameterAnalysis in pkg/scanning/parameterAnalysis.go runs two sequential worker stages that both write to the same results channel. The channel is correctly closed after the first stage completes (close(results) at line 438), but the second stage — which processes POST-body parameters (dp) — is then launched with the same already-closed channel as its output. When a scanned parameter is reflected, processParams executes results <- paramResult on the closed channel, triggering a Go runtime panic that crashes the entire dalfox process. In server mode, the crash is remotely triggerable by any unauthenticated caller who can reach the REST API, because the default configuration has no API key and the second stage activates whenever options.Data != "" (i.e., the attacker supplies the data field) and the target reflects at least one parameter. This vulnerability is fixed in 2.13.0.
A denial-of-service vulnerability has been identified in Dalfox, an open-source XSS scanner, in versions prior to 2.13.0. The issue arises in the ParameterAnalysis function, where two worker stages write to the same results channel. After the first stage completes, the channel is closed, but the second stage, which processes POST-body parameters, is launched using the closed channel. This leads to a Go runtime panic, crashing the Dalfox process. In server mode, the crash can be remotely triggered by any unauthenticated caller who can access the REST API, as the default configuration does not require an API key. The vulnerability activates when the data field is supplied, and the target reflects at least one parameter.
Users are advised to upgrade to Dalfox version 2.13.0, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 27, 2026CISA-ADP
Assessed May 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/hahwul/dalfox/security/advisories/GHSA-2g4x-fq3j-cgq4 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/hahwul/dalfox/releases/tag/v2.13.0 | [email protected] | Release NotesVendor |
| https://github.com/hahwul/dalfox/security/advisories/GHSA-2g4x-fq3j-cgq4 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-362 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | [email protected] |
| CWE-404 | Improper Resource Shutdown or Release | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Dalfox | <= 2.12.0 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | New CVE Received | [email protected] |