CVE-2021-32699: Asymmetric Resource Consumption in Pterodactyl Wings
Summary
CVE-2021-32699: Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings. Affects github.com/pterodactyl/wings versions < 1.4.4. Fixed in 1.4.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pterodactyl Wings is a Go-based software package that is used to create Docker containers. It provides a platform for managing and deploying game servers. The software allows users to easily create and manage containers, providing a streamlined experience for hosting game servers. However, prior to version 1.4.4, Pterodactyl Wings is vulnerable to an Asymmetric Resource Consumption (Amplification) vulnerability. This vulnerability allows a malicious user to consume more resources than intended, leading to system resource exhaustion. This can have downstream impacts on other clients sharing the same hardware, potentially causing the physical server to become unresponsive.
Vulnerability Detail
The vulnerability in Pterodactyl Wings arises from improper container process limits being defined. This allows a malicious user to exploit the system and consume excessive resources, leading to system resource exhaustion. The impact of this vulnerability can be severe, as it can disrupt the availability of the physical server and affect other clients sharing the same hardware. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level. The vulnerability has been assigned the identifier GHSA-jj6m-r8jc-2gp7.
How To Fix
Latest published version: v1.13.4 as of 22 Oct 2026
go get github.com/pterodactyl/wings@v1.13.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.4
This is the first release that contains the fix.
go get github.com/pterodactyl/wings@v1.4.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
For users running customized versions of Pterodactyl Wings, a manual workaround is available. They can manually set a PID limit for containers created, which can help mitigate the risk of resource exhaustion. However, it is strongly recommended to upgrade to the latest version to ensure comprehensive security fixes.
Conclusion
The Asymmetric Resource Consumption vulnerability in Pterodactyl Wings can lead to system resource exhaustion and impact the availability of the physical server. It is crucial for users to upgrade to version 1.4.4 or apply the recommended workaround to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/pterodactyl/wings →
FAQ
Pterodactyl Wings is a Go-based software package used for managing and deploying game servers in Docker containers.
The vulnerability allows a malicious user to consume excessive resources, leading to system resource exhaustion. This can impact the availability of the physical server and affect other clients sharing the same hardware.
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
To fix this vulnerability, users should upgrade to version 1.4.4 of Pterodactyl Wings.
For users running customized versions of Pterodactyl Wings, a manual workaround is available. They can manually set a PID limit for containers created.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/pterodactyl/wings.
