{"id":"CVE-2026-104057","published":"2026-10-01T19:17:19.160","lastModified":"2026-10-02T18:47:49.947","description":"Podgrab contains an unauthenticated denial-of-service vulnerability caused by unsynchronized concurrent access to shared maps (activePlayers and allConnections) in its WebSocket handler, where Wshandler and HandleWebsocketMessages goroutines read and write these maps without a mutex. A remote attacker can open multiple WebSocket connections to the /ws endpoint and send messages in a loop to trigger a Go runtime data race that crashes the process, causing a denial of service that requires operator intervention to restore service.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-362"],"vendors":[],"products":[],"references":[{"url":"https://gist.github.com/mansurmavlankulov/022bc672583687ccb34dcf4cb31b6188","tags":[]},{"url":"https://www.vulncheck.com/advisories/podgrab-unauthenticated-dos-via-concurrent-map-access-in-websocket-handler","tags":[]}],"exploitRefs":[{"url":"https://gist.github.com/mansurmavlankulov/022bc672583687ccb34dcf4cb31b6188","tags":[]}],"hasPoc":true,"ai":{"summary":"Podgrab has a race condition vulnerability in its WebSocket handler where multiple goroutines access shared data structures without synchronization, leading to potential crashes and denial of service.","exploitability":"Exploitation is straightforward as attackers only need to open multiple WebSocket connections to the /ws endpoint and send looping messages to trigger Go runtime data races that crash the process.","blast_radius":"The vulnerability can cause a complete denial of service requiring operator intervention to restart the service, affecting all users relying on Podgrab's WebSocket functionality.","remediation":"Upgrade to version 2.590 or later to fix the race condition in WebSocket handler.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["dos","websocket","race-condition"],"model":"garnet-coder","analyzedAt":"2026-10-12T09:05:50.270Z"}}