CVE-2026-104057: Podgrab Unauthenticated DoS via Concurrent Map Access in WebSocket Handler
Podgrab contains an unauthenticated denial-of-service vulnerability caused by unsynchronized concurrent access to shared maps (activePlayers and allConnections) in its WebSocket handler, where Wshandler and HandleWebsocketMessages goroutines read and write these maps without a mutex. A remote attacker can open multiple WebSocket connections to the /ws endpoint and send messages in a loop to trigger a Go runtime data race that crashes the process, causing a denial of service that requires operator intervention to restore service.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any remote attacker able to reach Podgrab's /ws WebSocket endpoint can exploit it. No authentication, privileges, or user interaction are required.
What does an attacker need to do to trigger the denial of service?
The attacker must open multiple WebSocket connections to /ws and send messages repeatedly. This can trigger concurrent unsynchronized access to the activePlayers and allConnections maps, crashing the Podgrab process.
What is the operational impact after exploitation?
The Podgrab process crashes and service is unavailable until an operator restores it. The provided information indicates an availability impact only, with no confidentiality or integrity impact.