Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-69198— Pterodactyl's improper resource locking allows raced queries to create more resources than alloted

Quick assessment

Affected
pterodactyl panel
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Pterodactyl Panel是Pterodactyl开源的一个免费的开源游戏服务器管理面板。 Pterodactyl Panel 1.12.0之前版本存在安全漏洞，该漏洞源于资源限制验证发生在请求周期早期且未在处理时锁定目标资源，可能导致恶意用户发送大量并发请求创建超出分配的资源，造成拒绝资源或过度消耗节点分配和备份空间。

AI Predicted 7.5 Difficulty: Moderate EPSS 0.24% · P14

Possible ATT&CK Techniques 1 AI

T1499.002 · Service Exhaustion Flood
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-69198

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Pterodactyl's improper resource locking allows raced queries to create more resources than alloted
Source: CVE Program / CVE List V5
Vulnerability Description
Pterodactyl is a free, open-source game server management panel. Pterodactyl implements rate limits that are applied to the total number of resources (e.g. databases, port allocations, or backups) that can exist for an individual server. These resource limits are applied on a per-server basis, and validated during the request cycle. However, in versions prior to 1.12.0, it is possible for a malicious user to send a massive volume of requests at the same time that would create more resources than the server is allotted. This is because the validation occurs early in the request cycle and does not lock the target resource while it is processing. As a result sending a large volume of requests at the same time would lead all of those requests to validate as not using any of the target resources, and then all creating the resources at the same time. As a result a server would be able to create more databases, allocations, or backups than configured. A malicious user is able to deny resources to other users on the system, and may be able to excessively consume the limited allocations for a node, or fill up backup space faster than is allowed by the system. Version 1.12.0 fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Vulnerability Title
Pterodactyl Panel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Pterodactyl Panel是Pterodactyl开源的一个免费的开源游戏服务器管理面板。 Pterodactyl Panel 1.12.0之前版本存在安全漏洞，该漏洞源于资源限制验证发生在请求周期早期且未在处理时锁定目标资源，可能导致恶意用户发送大量并发请求创建超出分配的资源，造成拒绝资源或过度消耗节点分配和备份空间。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
pterodactyl panel < 1.12.0 -

II. Public POCs for CVE-2025-69198

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-69198

请登录查看更多情报信息。

Vendor Advisories for CVE-2025-69198 (1)

Same Patch Batch · pterodactyl · 2026-01-19 · 3 CVEs total

CVE-2025-69199 Pterodactyl Wings's websocket endpoints have no visible rate limits or monitoring, allowin
CVE-2026-21696 Endless reprocessing/reupload of activity log data due to SQLite max parameters limit not

IV. Related Vulnerabilities

Same product: panel
Same vendor: pterodactyl
Same weakness: CWE-400

V. Comments for CVE-2025-69198

No comments yet

Leave a comment