Read the docs
TI-2026-17479 Aliases CVE-2026-21696GHSA-2497-gp99-2m74

Endless reprocessing/reupload of activity log data due to SQLite max parameters limit not being considered

Priority HIGH 75CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Starting in version 1.7.0 and prior to version 1.12.0, Wings does not consider SQLite max parameter limit when processing activity log entries allowing for low privileged user to trigger a condition that floods the panel with activity records. After Wings sends activity logs to the panel it deletes the processed activity entries from the wings SQLite database. However, it does not consider the max parameter limit of SQLite, 32766 as of SQLite 3.32.0. If wings attempts to delete more than 32766 entries from the SQLite database in one query, it triggers an error (SQL logic error: too many SQL variables (1)) and does not remove any entries from the database. These entries are then indefinitely re-processed and resent to the panel each time the cron runs. By successfully exploiting this vulnerability, an attacker can trigger a situation where wings will keep uploading the same activity data to the panel repeatedly (growing each time to include new activity) until the panels' database server runs out of disk space. Version 1.12.0 fixes the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00552 46th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed wings (pterodactyl): 1.12.0github.com/pterodactyl/wings (Go): 1.12.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pterodactylwings1.7.0 to before 1.12.01.12.0Patch availableCNA
—github.com/pterodactyl/wings (Go)1.7.0 to before 1.12.01.12.0Patch availableGHSA-2497-gp99-2m74
  • wings Vendorpterodactyl Affected 1.7.0 to before 1.12.0 Fixed in 1.12.0 Patch available CNA
  • github.com/pterodactyl/wings (Go) Vendor— Affected 1.7.0 to before 1.12.0 Fixed in 1.12.0 Patch available GHSA-2497-gp99-2m74

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pterodactyl:wings:*:*:*:*:*:*:*:*1.7.0 to before 1.12.0Vulnerablepterodactyl
  • cpe:2.3:a:pterodactyl:wings:*:*:*:*:*:*:*:* Versions 1.7.0 to before 1.12.0 Vulnerable ·pterodactyl

Remediation

  • Fix · CNA wings (pterodactyl) Fixed in 1.12.0
  • Fix · GHSA-2497-gp99-2m74 github.com/pterodactyl/wings (Go) Fixed in 1.12.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-21696
  2. 2026-10-03 Alias added: GHSA-2497-gp99-2m74

References

Exploit 1

Advisory 1

Other 5

  • TI-2024-17963 Improper isolation of server file access in github.com/pterodactyl/wings CVSS 3.1CRITICAL 10.0
  • TI-2023-15384 Wings vulnerable to escape to host from installation container CVSS 3.1CRITICAL 9.1
  • TI-2023-10630 Symbolic Link (Symlink) Following allowing the deletion of files and directories on the host system in wings CVSS 3.1CRITICAL 9.6
  • TI-2024-22524 Arbitrary File Write/Read in Pterodactyl wings CVSS 3.1HIGH 8.5
  • TI-2023-10614 Symbolic Link (Symlink) Following in github.com/pterodactyl/wings CVSS 3.1HIGH 8.8
  • TI-2025-42653 Uncontrolled resource consumption in pterodactyl panel CVSS 4.0HIGH 8.3
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences