Listen to this Post
The vulnerability exploits the lack of rate limiting and message size limits in websocket endpoints within Pterodactyl’s Wings daemon. Websockets are persistent connections used for real-time communication between the panel and game servers. Attackers can establish numerous websocket connections to the Wings daemon, each consuming system resources. Without throttling, malicious users send continuous data requests or large payloads over these connections. This floods the network interface and overwhelms the host’s CPU and memory. The attack leverages the absence of connection quotas per IP, allowing unlimited socket creation. Each connection maintains state, increasing memory usage. Message buffers are not capped, so sending gigantic data chunks exhausts network bandwidth. The daemon processes all incoming messages, spiking CPU utilization. This resource starvation denies service to legitimate users. Attack scripts can automate connection spawning and data transmission. The vulnerability is network-accessible, requiring no authentication for initial websocket handshake. Persistent connections prevent resource release, leading to gradual degradation. System monitoring tools may not track websocket traffic, delaying detection. The attack can be distributed from multiple IPs to bypass naive IP-based filters. Overall, it’s a classic resource exhaustion vector due to missing application-layer controls.
Platform: Pterodactyl Panel
Version: All versions
Vulnerability: Rate Limit Bypass
Severity: High
date: 2026-01-19
Prediction: Patch by 2026-02-28
What Undercode Say:
Analytics
!/bin/bash
Simulate websocket connections for testing
for i in {1..1000}; do
wscat -c ws://localhost:8080/ws -x ‘{“data”:”large_payload”}’
done
Monitor system resources during attack
top -b -n 1 | grep wings
netstat -an | grep :8080 | wc -l
Code snippet showing missing rate limit in Wings
func handleWebSocket(conn websocket.Conn) {
// No rate limiting implemented
for {
message, _ := conn.ReadMessage()
processMessage(message) // Resource-intensive
}
}
How Exploit:
Open multiple websockets using scripts, send large messages continuously, target Wings daemon, exhaust host resources, cause denial-of-service.
Protection from this CVE
Implement rate limiting, throttle connections, cap message size, monitor websocket traffic, use WAF, patch Wings.
Impact:
Service disruption, resource exhaustion, increased latency, potential downtime, affecting game servers.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
