PT-2026-3486 · Pterodactyl · Wings

Published 2026-01-19 · Updated 2026-02-06 · CVE-2025-69199

Positive Technologies (AI Summary)

CVSS v4.0

8.3

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Name of the Vulnerable Software and Affected Versions Wings versions prior to 1.12.0

Description Wings, the server control plane for Pterodactyl, is affected by an issue where websockets lack appropriate rate limiting and throttling. This allows a malicious user to establish numerous connections and request data, potentially overwhelming the host system's memory and CPU. Furthermore, there is no limit on the size of messages sent or received, enabling an attacker to open thousands of websocket connections and transmit large amounts of data, leading to network overload and increased CPU and memory usage within Wings.

Recommendations Update to version 1.12.0 or later.

Exploit

Fix

DoS

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

CVE-2025-69199

GHSA-8W7M-W749-RX98

GO-2026-4331

SUSE-SU-2026:0403-1

Affected Products

Wings

References · 90

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69199.json · Exploit
• https://github.com/pterodactyl/panel/security/advisories/GHSA-8w7m-w749-rx98 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-69199 · Security Note
• https://osv.dev/vulnerability/CVE-2025-69199 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4331 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8w7m-w749-rx98 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0403-1 · Vendor Advisory
• https://github.com/pterodactyl/panel · Note
• https://github.com/pterodactyl/panel/releases/tag/v1.12.0 · Note
• https://github.com/pterodactyl/panel/commit/09caa0d4995bd924b53b9a9e9b4883ac27bd5607 · Note
• https://suse.com/security/cve/CVE-2026-25122 · Note
• https://suse.com/security/cve/CVE-2026-23954 · Note
• https://suse.com/security/cve/CVE-2026-20736 · Note
• https://suse.com/security/cve/CVE-2023-43631 · Note
• https://suse.com/security/cve/CVE-2026-23829 · Note