CVE-2026-45090: Dalfox: Unauthenticated Remote DoS via Closed-Channel Write in `ParameterAnalysis` (server mode)

Synopsis

This is a denial-of-service vulnerability in Dalfox, an open-source XSS scanning tool. When running in server mode, an unauthenticated remote attacker can trigger a Go runtime panic by sending a crafted API request that causes a write to an already-closed results channel inside the ParameterAnalysis worker pipeline. Successful exploitation crashes the entire Dalfox process, making the scanner unavailable. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Dalfox REST API over the network; in the default server-mode configuration there is no network restriction, so any host that can route to the server is a potential source.

• AuthenticationNot required

  The default Dalfox server configuration requires no API key, so no credentials are needed to submit a scan request.

• Victim interactionNot required

  No user action is required; the attacker triggers the crash entirely through a crafted API request without any involvement from a legitimate user.

• Attack complexityDetail

  Exploitation is reliable and condition-free given a reachable target: the attacker simply supplies a non-empty data field and a target that reflects at least one parameter, both of which are attacker-controlled inputs.

Blast Radius

• The Dalfox server process crashes immediately on a successful panic, dropping all in-progress scans and making the REST API unreachable until the process is manually restarted.
• Any queued or running scan jobs at the time of the crash are lost, disrupting automated security pipeline workflows that depend on Dalfox for XSS detection.
• No confidentiality or integrity impact is present; the attacker gains no read or write access to data, only the ability to halt the service.