GHSA-8w7m-w749-rx98

Source

https://github.com/advisories/GHSA-8w7m-w749-rx98

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-8w7m-w749-rx98/GHSA-8w7m-w749-rx98.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-8w7m-w749-rx98

Aliases

CVE-2025-69199

Published

2026-01-20T16:30:40Z

Modified

2026-01-20T19:15:13.677831Z

Severity

8.3 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H CVSS Calculator

Summary

Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks

Details

Summary

Websockets within wings lack proper rate limiting and throttling. As a result a malicious user can open a large number of connections and then request data through these sockets, causing an excessive volume of data over the network and overloading the host system memory and cpu.

Additionally, there is not a limit applied to the total size of messages being sent or received, allowing a malicious user to open thousands of websocket connections and then send massive volumes of information over the socket, overloading the host network, and causing increased CPU and memory load within Wings.

Database specific

{
    "cwe_ids": [
        "CWE-770"
    ],
    "severity": "HIGH",
    "nvd_published_at": "2026-01-19T20:15:48Z",
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-20T16:30:40Z"
}

References

Affected packages

Go / github.com/pterodactyl/wings

Package

Name: github.com/pterodactyl/wings; View open source insights on deps.dev
Purl: pkg:golang/github.com/pterodactyl/wings

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.12.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-8w7m-w749-rx98/GHSA-8w7m-w749-rx98.json"