CVE-2026-35202

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-35202
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35202.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-35202
Aliases
Published
2026-06-02T19:03:46.792Z
Modified
2026-07-24T03:57:10.303394587Z
Severity
  • 2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
Pterodactyl has a database resource limit bypass via race condition in Client API
Details

Pterodactyl is a free, open-source game server management panel. Prior to version 1.12.3, the Pterodactyl Client API has a logic flaw that lets users bypass their assigned limits for database allocations. This happens because the database locking mechanism used in the controllers is totally broken and doesn't actually lock anything. Version 1.12.3 patches the issue.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35202.json",
    "cwe_ids": [
        "CWE-367",
        "CWE-770"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/pterodactyl/panel

Affected ranges

Type
GIT
Repo
https://github.com/pterodactyl/panel
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
a94b8bdb4e912468af23e70bc137145bc6123ec2
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.12.3"
        }
    ]
}

Affected versions

v0.*
v0.1.0-beta
v0.1.1-beta
v0.1.2-beta
v0.2.0-beta
v0.3.0-beta
v0.4.0-beta
v0.4.1-beta
v0.5.0
v1.*
v1.0.0
v1.0.0-rc.1
v1.0.0-rc.3
v1.0.0-rc.4
v1.0.0-rc.5
v1.0.0-rc.6
v1.0.0-rc.7
v1.0.1
v1.0.2
v1.0.3
v1.1.0
v1.1.1
v1.1.2
v1.1.3
v1.10.0
v1.10.1
v1.10.2
v1.10.3
v1.10.4
v1.11.0
v1.11.0-rc.1
v1.11.0-rc.2
v1.11.1
v1.11.2
v1.11.3
v1.11.4
v1.11.5
v1.11.6
v1.11.7
v1.12.0
v1.12.1
v1.12.2
v1.2.0
v1.2.1
v1.2.2
v1.3.0
v1.3.1
v1.3.2
v1.4.0
v1.4.1
v1.4.2
v1.5.0
v1.5.1
v1.6.0
v1.6.1
v1.6.2
v1.6.3
v1.6.5
v1.6.6
v1.7.0
v1.8.0
v1.8.1
v1.9.0
v1.9.1
v1.9.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35202.json"