← Vulnerability feed

Vulnerability record · CVE-2026-21696 · published 19 January 2026

CVE-2026-21696: Pterodactyl wings uncontrolled resource consumption vulnerability

Pterodactyl · Wings

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Starting in version 1.7.0 and prior to version 1.12.0, Wings does not consider SQLite max parameter limit when processing activity log entries allowing for low privileged user to trigger a condition that floods the panel with activity records. After Wings sends activity logs to the panel it deletes the processed activity entries from the wings SQLite database. However, it does not consider the max parameter limit of SQLite, 32766 as of SQLite 3.32.0. If wings attempts to delete more than 32766 entries from the SQLite database in one query, it triggers an error (SQL logic error: too many SQL variables (1)) and does not remove any entries from the database. These entries are then indefinitely re-processed and resent to the panel each time the cron runs. By successfully exploiting this vulnerability, an attacker can trigger a situation where wings will keep uploading the same activity data to the panel repeatedly (growing each time to include new activity) until the panels' database server runs out of disk space. Version 1.12.0 fixes the issue.

8.3 CVSS 4.0 High EPSS 0.54% · top 56.8% CWE-400 · Uncontrolled resource consumptionCWE-770 · Allocation without limits
8.3CVSS 4.0 base score
0.54%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References, 1 tagged exploit
17 Jun 2026Last modified by NVD

Description

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Starting in version 1.7.0 and prior to version 1.12.0, Wings does not consider SQLite max parameter limit when processing activity log entries allowing for low privileged user to trigger a condition that floods the panel with activity records. After Wings sends activity logs to the panel it deletes the processed activity entries from the wings SQLite database. However, it does not consider the max parameter limit of SQLite, 32766 as of SQLite 3.32.0. If wings attempts to delete more than 32766 entries from the SQLite database in one query, it triggers an error (SQL logic error: too many SQL variables (1)) and does not remove any entries from the database. These entries are then indefinitely re-processed and resent to the panel each time the cron runs. By successfully exploiting this vulnerability, an attacker can trigger a situation where wings will keep uploading the same activity data to the panel repeatedly (growing each time to include new activity) until the panels' database server runs out of disk space. Version 1.12.0 fixes the issue.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/pterodactyl/wings/blob/9ffbcdcdb1163da823cf9959b9602df9f7dcb54a/internal/cron/activity_cron.go#L81 Product
https://github.com/pterodactyl/wings/blob/9ffbcdcdb1163da823cf9959b9602df9f7dcb54a/internal/cron/sftp_cron.go#L86 Product
https://github.com/pterodactyl/wings/security/advisories/GHSA-2497-gp99-2m74 ExploitVendor Advisory

Track CVE-2026-21696 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2023-32080Pterodactyl wings execution with unnecessary privileges vulnerabilityWings is the server control plane for Pterodactyl Panel. A vulnerability affecting versions prior to 1.7.5 and versions 1.11.0 prior to 1.11.6 impact…EPSS 0.92%8.8CVE-2023-25152Pterodactyl wings link following vulnerabilityWings is Pterodactyl's server control plane. Affected versions are subject to a vulnerability which can be used to create new files and directory str…EPSS 0.68%8.5CVE-2024-27102Pterodactyl wings path traversal vulnerabilityWings is the server control plane for Pterodactyl Panel. This vulnerability impacts anyone running the affected versions of Wings. The vulnerability …EPSS 0.55%8.4CVE-2024-34066Pterodactyl wings vulnerabilityPterodactyl wings is the server control plane for Pterodactyl Panel. If the Wings token is leaked either by viewing the node configuration or posting…EPSS 0.54%8.3CVE-2025-69199Pterodactyl wings uncontrolled resource consumption vulnerabilityWings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.12.0, websockets within wings…EPSS 0.29%8.2CVE-2023-25168Pterodactyl wings link following vulnerabilityWings is Pterodactyl's server control plane. This vulnerability can be used to delete files and directories recursively on the host system. This vuln…EPSS 0.96%7.5CVE-2025-68954Pterodactyl panel insufficient session expiration vulnerabilityPterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP connections when a user is remo…EPSS 0.25%6.5CVE-2021-32699Pterodactyl wings uncontrolled resource consumption vulnerabilityWings is the control plane software for the open source Pterodactyl game management system. All versions of Pterodactyl Wings prior to `1.4.4` are vu…EPSS 0.27%

Source: NIST National Vulnerability Database (record CVE-2026-21696), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.