GHSA-2g4x-fq3j-cgq4: Dalfox has an Unauthenticated Remote DoS via Closed-Channel Write in `ParameterAnalysis` (server mode)
Summary
Dalfox, a security scanning tool, has a vulnerability in its server mode where an unauthenticated attacker can crash the entire process by sending a specially crafted request. The bug occurs because the code closes a communication channel (a Go channel, which is used to pass data between concurrent tasks) after the first stage of parameter scanning finishes, but then tries to use that same closed channel in a second stage, causing a runtime panic (an unrecoverable error that terminates the program). Since the server has no authentication by default and listens on all network interfaces, any remote attacker can trigger this crash.
Vulnerability Details
EPSS: 0.0%
Yes
May 12, 2026
Classification
Affected Packages
Original source: https://github.com/advisories/GHSA-2g4x-fq3j-cgq4
First tracked: May 12, 2026 at 02:00 PM
Classified by LLM (prompt v3) · confidence: 95%