Skip to content
OpenAdvisories
High · 8.3 CVE-2025-69199 EUVD-2025-206299GHSA-8w7m-w749-rx98GO-2026-4331

Pterodactyl Wings's websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks under certain circumstances

Published Jan 19, 2026 · Updated Jan 20, 2026 · Assigned by GitHub_M

Description

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.12.0, websockets within wings lack proper rate limiting and throttling. As a result a malicious user can open a large number of connections and then request data through these sockets, causing an excessive volume of data over the network and overloading the host system memory and cpu. Additionally, there is not a limit applied to the total size of messages being sent or received, allowing a malicious user to open thousands of websocket connections and then send massive volumes of information over the socket, overloading the host network, and causing increased CPU and memory load within Wings. Version 1.12.0 patches the issue.

Affected products

VendorProductAffectedFixed
pterodactyl panel < 1.12.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21483-1
openSUSE Leap 15.6 govulncheck-vulndb 0.0.20260205T172317-150000.1.146.1 SUSE-SU-2026:0403-1

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/pterodactyl/wings < 1.12.0 1.12.0 GHSA-8w7m-w749-rx98

Advisories 2

References