Skip to content
OpenAdvisories
High · 7.5 CVE-2026-104057 EUVD-2026-91004GHSA-mg2r-35f6-8r8h

Podgrab Unauthenticated DoS via Concurrent Map Access in WebSocket Handler

Published Oct 1, 2026 · Updated Oct 13, 2026 · Assigned by VulnCheck

Description

Podgrab contains an unauthenticated denial-of-service vulnerability caused by unsynchronized concurrent access to shared maps (activePlayers and allConnections) in its WebSocket handler, where Wshandler and HandleWebsocketMessages goroutines read and write these maps without a mutex. A remote attacker can open multiple WebSocket connections to the /ws endpoint and send messages in a loop to trigger a Go runtime data race that crashes the process, causing a denial of service that requires operator intervention to restore service.

Affected products

VendorProductAffectedFixed
akhilrex podgrab — —

References