CVE-2025-69199

The record

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.12.0, websockets within wings lack proper rate limiting and throttling. As a result a malicious user can open a large number of connections and then request data through these sockets, causing an excessive volume of data over the network and overloading the host system memory and cpu. Additionally, there is not a limit applied to the total size of messages being sent or received, allowing a malicious user to open thousands of websocket connections and then send massive volumes of information over the socket, overloading the host network, and causing increased CPU and memory load within Wings. Version 1.12.0 patches the issue.

Affected packages

Related vulnerabilities

• GO-2026-4331 Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for… Same vulnerability
• GHSA-hr7j-63v7-vj7g Pterodactyl Panel's SFTP sessions remain active after user account deletion or password… Also affects github.com/pterodactyl/wings
• GO-2026-4329 Pterodactyl endlessly reprocesses/reuploads activity log data due to SQLite max… Also affects github.com/pterodactyl/wings
• CVE-2026-21696 Wings is the server control plane for Pterodactyl, a free, open-source game server… Also affects github.com/pterodactyl/wings
• GHSA-8c39-xppg-479c Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced Also affects github.com/pterodactyl/wings
• CVE-2025-68954 Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced Also affects github.com/pterodactyl/wings
• CVE-2026-33990 Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using… Also affects govulncheck-vulndb
• CVE-2026-34204 MinIO is a high-performance object storage system. Also affects govulncheck-vulndb