CVE-2021-32699 MEDIUM

CVE-2021-32699: Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings

Vendor Pterodactyl
Product wings
Weakness CWE-400
Published June 22, 2021
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

What the vulnerability does

01Description

Wings is the control plane software for the open source Pterodactyl game management system. All versions of Pterodactyl Wings prior to `1.4.4` are vulnerable to system resource exhaustion due to improper container process limits being defined. A malicious user can consume more resources than intended and cause downstream impacts to other clients on the same hardware, eventually causing the physical server to stop responding. Users should upgrade to `1.4.4` to mitigate the issue. There is no non-code based workaround for impacted versions of the software. Users running customized versions of this software can manually set a PID limit for containers created.

Key dates

02Disclosure timeline

June 22, 2021 CVE published
August 3, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-44892 Netty has a Vulnerable Default Configuration Which Leads to Denial of Service via Unbounded HTTP/3 Header Size CVE-2026-49851 Mistune: Potential DoS via quadratic-time parsing in parse_link_text CVE-2026-41708 Spring Cloud Sleuth instrumentation of Spring TX DoS vulnerability CVE-2026-49090 Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service CVE-2026-47904 CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)