Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks

🗓️ 20 Jan 2026 16:30:40Reported by GitHub Advisory DatabaseType

Pterodactyl websockets lack rate and size limits, enabling denial of service from many connections.

Reporter	Title	Published	Views	Family All 20
ATTACKERKB	CVE-2025-69199	19 Jan 202619:17	–	attackerkb
CNNVD	Pterodactyl Panel security vulnerabilities	19 Jan 202600:00	–	cnnvd
CVE	CVE-2025-69199	19 Jan 202619:17	–	cve
Cvelist	CVE-2025-69199 Pterodactyl Wings's websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks under certain circumstances	19 Jan 202619:17	–	cvelist
EUVD	EUVD-2025-206299	20 Jan 202616:30	–	euvd
NVD	CVE-2025-69199	19 Jan 202620:15	–	nvd
OSV	CVE-2025-69199 Pterodactyl Wings's websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks under certain circumstances	19 Jan 202619:17	–	osv
OSV	GHSA-8W7M-W749-RX98 Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks	20 Jan 202616:30	–	osv
OSV	GO-2026-4331 Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings	3 Feb 202620:37	–	osv
OSV	SUSE-SU-2026:0403-1 Security update for govulncheck-vulndb	6 Feb 202616:58	–	osv

Vulners

Node

Source	Link
github	www.github.com/pterodactyl/panel/security/advisories/GHSA-8w7m-w749-rx98
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-69199
github	www.github.com/pterodactyl/panel/commit/09caa0d4995bd924b53b9a9e9b4883ac27bd5607
github	www.github.com/pterodactyl/panel/releases/tag/v1.12.0
github	www.github.com/advisories/GHSA-8w7m-w749-rx98

02 Feb 2026 22:21Current

5.5Medium risk

Vulners AI Score5.5

CVSS 3.16.5

CVSS 48.3

EPSS0.00251

SSVC