PT-2026-3485 · Unknown · Pterodactyl

Published 2026-01-19 · Updated 2026-02-02 · CVE-2025-69198

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Pterodactyl versions prior to 1.12.0

Description Pterodactyl is a game server management panel that applies rate limits to resources like databases, port allocations, and backups on a per-server basis. In versions before 1.12.0, a malicious user could bypass these limits by sending a large number of requests simultaneously. The validation process doesn't lock resources during processing, allowing multiple requests to create resources exceeding the configured limits. This could lead to resource exhaustion for other users, excessive node allocation consumption, or rapid backup space filling. The issue arises from the timing of validation occurring before resource locking during the request cycle.

Recommendations Update to Pterodactyl version 1.12.0 or later.

Exploit

Fix

Resource Exhaustion

Improper Locking

Race Condition

Weakness Enumeration

CWE-400

CWE-413

CWE-667

CWE-362

Related Identifiers

CVE-2025-69198

GHSA-JW2V-CQ5X-Q68G

Affected Products

Pterodactyl

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69198.json · Exploit
• https://github.com/pterodactyl/panel/security/advisories/GHSA-jw2v-cq5x-q68g · Vendor Advisory
• https://github.com/pterodactyl/panel/commit/09caa0d4995bd924b53b9a9e9b4883ac27bd5607 · Patch
• https://osv.dev/vulnerability/GHSA-jw2v-cq5x-q68g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-69198 · Security Note
• https://osv.dev/vulnerability/CVE-2025-69198 · Vendor Advisory
• https://github.com/pterodactyl/panel · Note
• https://t.me/cveNotify/150646 · Telegram Post
• https://twitter.com/CVEnew/status/2013335726889541910 · Twitter Post