Dalfox, an open‑source XSS scanner, contains a flaw in its ParameterAnalysis routine where two sequential worker stages write to the same results channel. The first stage correctly closes the channel after completion, but the second stage—processing POST‑body parameters—continues to write to the already‑closed channel. When a scanned parameter is reflected, a Go runtime panic occurs, which crashes the entire dalfox process. This bug is a classic example of a closed‑channel write leading to denial of service, classified under CWE‑362 and CWE‑404.

The vulnerability affects the hahwul:dalfox application, specifically all releases prior to version 2.13.0. Any instance of Dalfox running in server mode with the default configuration (no API key) is vulnerable.

The CVSS score of 7.5 indicates high severity, and the lack of an EPSS metric or KEV listing does not diminish the risk because the flaw is remotely triggerable without authentication via the REST API. The attacker only needs to supply a POST request with a data field that causes a reflected parameter; the second stage then writes to the closed channel and crashes the service. The exploit is straightforward, requiring no privileged access, and the impact is a complete service disruption until the process is restarted or patched.