GHSA-2497-gp99-2m74

Suggest an improvement
Source
https://github.com/advisories/GHSA-2497-gp99-2m74
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-2497-gp99-2m74/GHSA-2497-gp99-2m74.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-2497-gp99-2m74
Aliases
Published
2026-01-20T16:30:54Z
Modified
2026-01-20T19:15:17.455437Z
Severity
  • 8.3 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H CVSS Calculator
Summary
Pterodactyl endlessly reprocesses/reuploads activity log data due to SQLite max parameters limit not being considered
Details

Summary

Wings does not consider SQLite max parameter limit when processing activity log entries allowing for low privileged user to trigger a condition that floods the panel with activity records

Details

After wings sends activity logs to the panel it deletes the processed activity entries from the wings SQLite database. However, it does not consider the max parameter limit of SQLite, 32766 as of SQLite 3.32.0.

If wings attempts to delete more than 32766 entries from the SQLite database in one query, it triggers an error (SQL logic error: too many SQL variables (1)) and does not remove any entries from the database. These entries are then indefinitely re-processed and resent to the panel each time the cron runs.

https://github.com/pterodactyl/wings/blob/9ffbcdcdb1163da823cf9959b9602df9f7dcb54a/internal/cron/activitycron.go#L81 https://github.com/pterodactyl/wings/blob/9ffbcdcdb1163da823cf9959b9602df9f7dcb54a/internal/cron/sftpcron.go#L86

PoC

Any method that can create the required 32767+ activity entries can trigger this vulnerability. It can (and has) been triggered by normal (non-malicious) use. I attached a simple PoC I used while verifying this that uses sftp to quickly create many small files, thus creating activity entries in the SQLite database. https://ptero.co/mococesoca.go

Impact

By successfully exploiting this vulnerability you can trigger a situation where wings will keep uploading the same activity data to the panel repeatedly (growing each time to include new activity) until the panels’ database server runs out of disk space.

Database specific 
{
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-20T16:30:54Z",
    "severity": "HIGH",
    "nvd_published_at": "2026-01-19T20:15:49Z",
    "cwe_ids": [
        "CWE-770"
    ]
}
References

Affected packages

Go / github.com/pterodactyl/wings

Package

Name
github.com/pterodactyl/wings
View open source insights on deps.dev
Purl
pkg:golang/github.com/pterodactyl/wings

Affected ranges

Type
SEMVER
Events
Introduced
1.7.0
Fixed
1.12.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-2497-gp99-2m74/GHSA-2497-gp99-2m74.json"