Skip to content
Fencer Vulns
medium 6.5

CVE-2021-32699 json

Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings

published 2021-06-22 5 y ago modified 2026-07-08 4 mo ago also GHSA-jj6m-r8jc-2gp7 , GO-2022-0919 , EUVD-2021-1344

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 18%
public exploits
0
none known

Summary

Wings is the control plane software for the open source Pterodactyl game management system. All versions of Pterodactyl Wings prior to `1.4.4` are vulnerable to system resource exhaustion due to improper container process limits being defined. A malicious user can consume more resources than intended and cause downstream impacts to other clients on the same hardware, eventually causing the physical server to stop responding. Users should upgrade to `1.4.4` to mitigate the issue. There is no non-code based workaround for impacted versions of the software. Users running customized versions of this software can manually set a PID limit for containers created.

Patch / fix

  • go github.com/pterodactyl/wings 1.4.4
  • pterodactyl wings 1.4.4

Exploit prediction

0.27% chance of exploitation in the next 30 days, higher than 18% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
NVD 3.1 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
NVD 2.0 2.1 AV:L/AC:L/Au:N/C:N/I:N/A:P
GitHub 3.1 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
go github.com/pterodactyl/wings
<1.4.4
1.4.4

Affected products

  • pterodactyl wings

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption
  • CWE-770 Allocation of Resources Without Limits or Throttling
  • CWE-405 Asymmetric Resource Consumption (Amplification)

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.