CVE-2026-26201: emp3r0r Affected by Concurrent Map Access DoS (panic/crash)

February 17, 2026 (updated February 19, 2026)

Multiple shared maps are accessed without consistent synchronization across goroutines. Under concurrent activity, Go runtime can trigger fatal error: concurrent map read and map write, causing C2 process crash (availability loss).

References

github.com/advisories/GHSA-f5p9-j34q-pwcc
github.com/jm33-m0/emp3r0r
github.com/jm33-m0/emp3r0r/commit/ea4d074f081dac6293f3aec38f01def5f08d5af5
github.com/jm33-m0/emp3r0r/releases/tag/v3.21.2
github.com/jm33-m0/emp3r0r/security/advisories/GHSA-f5p9-j34q-pwcc
nvd.nist.gov/vuln/detail/CVE-2026-26201

Code Behaviors & Features

Detect and mitigate CVE-2026-26201 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →