CVE-2026-61554 Details

A denial-of-service vulnerability has been identified in emp3r0r, a command-and-control (C2) tool for Linux environments. Prior to version 4.2.5, the 'http_poll' C2 transport allowed remote unauthenticated attackers to create arbitrary polling sessions before completing the required authentication. Exploitation of this vulnerability could lead to increased server resource consumption and disruption of C2 operations.

To address this vulnerability, emp3r0r users should update to version 4.2.5 or later, and ensure that authentication is required before establishing long-lived HTTP polling sessions. Additionally, request bodies should not be forwarded into the C2 stream before validation, and strict limits should be imposed on request body sizes.