CVE-2026-104057Podgrab Unauthenticated DoS via Concurrent Map Access in WebSocket Handler
Updated under an hour ago ()
Does this affect you?
It affects akhilrex podgrab. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 0.27%, higher than 17% of scored CVEs.
Do this next
Free account, 1 product
Podgrab contains an unauthenticated denial-of-service vulnerability caused by unsynchronized concurrent access to shared maps (activePlayers and allConnections) in its WebSocket handler, where Wshandler and HandleWebsocketMessages goroutines read and write these maps without a mutex. A remote attacker can open multiple WebSocket connections to the /ws endpoint and send messages in a loop to trigger a Go runtime data race that crashes the process, causing a denial of service that requires operator intervention to restore service.
- CVSS
- 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- CWE-362
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 0.27% (percentile 17)
- Assigned by
- VulnCheck
- NVD analysis
- Deferred
- Record last updated
- Oct 13, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
akhilrex podgrab akhilrex:podgrab (from the name) | through 032248091294dbf5b6a439a5afd93788a7cc647f | CNA record |
References
- https://gist.github.com/mansurmavlankulov/022bc672583687ccb34dcf4cb31b6188technical-description
- https://www.vulncheck.com/advisories/podgrab-unauthenticated-dos-via-concurrent-map-access-in-websocket-handlerthird-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.