6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-69198

CVE-2025-69198: Pterodactyl's improper resource locking allows raced queries to create more resources than alloted

Pterodactyl is a free, open-source game server management panel. Pterodactyl implements rate limits that are applied to the total number of resources (e.g. databases, port allocations, or backups) that can exist for an individual server. These resource limits are applied on a per-server basis, and validated during the request cycle. However, in versions prior to 1.12.0, it is possible for a malicious user to send a massive volume of requests at the same time that would create more resources than the server is allotted. This is because the validation occurs early in the request cycle and does not lock the target resource while it is processing. As a result sending a large volume of requests at the same time would lead all of those requests to validate as not using any of the target resources, and then all creating the resources at the same time. As a result a server would be able to create more databases, allocations, or backups than configured. A malicious user is able to deny resources to other users on the system, and may be able to excessively consume the limited allocations for a node, or fill up backup space faster than is allowed by the system. Version 1.12.0 fixes the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-69198

CVE-2025-69198:

6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pterodactyl/panel	composer	< 1.12.0	1.12.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic race condition affecting multiple resource creation endpoints in the Pterodactyl panel. The core issue lies in how the application checked for resource limits (e.g., number of databases, backups, or network allocations per server). The application would first query the current count of a resource, compare it to the allowed limit, and if the check passed, it would proceed to create the new resource. However, this 'check-then-act' sequence was not atomic. An attacker could exploit this by sending a large number of concurrent API requests to create a resource. All these requests would execute the 'check' phase simultaneously, and all would pass because none of the requests had yet completed the 'act' phase of actually creating the resource and incrementing the count. Consequently, the system would create more resources than the configured limit, leading to resource exhaustion and denial of service for other users.

The patch addresses this vulnerability by introducing pessimistic locking. In the modified code, the store methods for BackupController, DatabaseController, and NetworkAllocationController now use lockForUpdate() within a database transaction. This ensures that when one request is checking the resource count and creating a new resource for a specific server, the corresponding database rows are locked, forcing any other concurrent requests for the same server to wait until the first transaction is complete. This serializes the creation process and correctly enforces the resource limits.

Vulnerable functions

Pterodactyl\Http\Controllers\Api\Client\Servers\BackupController.store

app/Http/Controllers/Api/Client/Servers/BackupController.php

This function handles the creation of server backups. Before the patch, it did not lock the backup resources for the server during the creation process. This allowed multiple concurrent requests to bypass the backup limit, as each request would validate the limit before the others had completed, leading to the creation of more backups than allotted. The patch introduces `lockForUpdate()` to prevent this race condition.

Pterodactyl\Http\Controllers\Api\Client\Servers\DatabaseController.store

app/Http/Controllers/Api/Client/Servers/DatabaseController.php

This function handles the creation of new databases for a server. The vulnerability existed because the function did not implement a lock when checking the current database count and creating a new one. This allowed a malicious user to send many simultaneous requests, all of which would pass the validation check before the database count was updated, resulting in the creation of more databases than the server's configured limit. The patch introduces `lockForUpdate()` to make the operation atomic.

Pterodactyl\Http\Controllers\Api\Client\Servers\NetworkAllocationController.store

app/Http/Controllers/Api/Client/Servers/NetworkAllocationController.php

This function creates new network allocations for a server. The original code checked the allocation count against the server's limit without locking the allocations table. This created a race condition where multiple requests could be sent at once, each seeing the count as below the limit, and then all proceeding to create a new allocation, thus exceeding the intended limit. The patch fixes this by using `lockForUpdate()` during the count check.

Pterodactyl\Http\Controllers\Api\Client\Servers\DatabaseController.rotatePassword

app/Http/Controllers/Api/Client/Servers/DatabaseController.php

This function handles rotating the password for a database. While not a resource exhaustion vulnerability like the others, the patch indicates a similar race condition was present where concurrent requests could lead to undefined behavior. The fix introduces a lock on the specific database row (`lockForUpdate()`) during the password update operation to ensure atomicity.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.