CVE-2026-104057

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-01

Last updated on: 2026-10-02

Assigner: VulnCheck

Description

Podgrab contains an unauthenticated denial-of-service vulnerability caused by unsynchronized concurrent access to shared maps (activePlayers and allConnections) in its WebSocket handler, where Wshandler and HandleWebsocketMessages goroutines read and write these maps without a mutex. A remote attacker can open multiple WebSocket connections to the /ws endpoint and send messages in a loop to trigger a Go runtime data race that crashes the process, causing a denial of service that requires operator intervention to restore service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-01

Last Modified

2026-10-02

Generated

2026-10-19

AI Q&A

2026-10-01

EPSS Evaluated

2026-10-18

NVD

CVE-2026-104057

EUVD

EUVD-2026-91004

Affected Vendors & Products

Vendor	Product	Version / Range
akhilrex	podgrab	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

Executive Summary

This is an unauthenticated denial-of-service (DoS) vulnerability in Podgrab caused by unsynchronized concurrent access to shared maps in its WebSocket handler. Multiple goroutines read and write to activePlayers and allConnections maps without a mutex, leading to a Go runtime data race that crashes the process when an attacker sends repeated messages via multiple WebSocket connections to the /ws endpoint.

Detection Guidance

Monitor for excessive WebSocket connections to the /ws endpoint. Check for repeated messages from the same source. Look for Go runtime crashes or panics in logs. Use tools like netstat or ss to track active connections to /ws.

Impact Analysis

An attacker could exploit this to crash the Podgrab service, causing downtime and requiring manual intervention to restore service. Since the /ws endpoint is unauthenticated, anyone can trigger this issue without needing credentials, making it easy to abuse.

Compliance Impact

This vulnerability primarily causes denial-of-service conditions by crashing the application through race conditions. While it does not directly expose or leak data, prolonged downtime could impact availability of services handling personal or sensitive information. Compliance frameworks like GDPR and HIPAA require maintaining availability of systems processing personal data, so repeated outages may lead to non-compliance if service levels are not restored promptly.

Mitigation Strategies

Restrict access to the /ws endpoint by requiring authentication. Add mutex locks to the shared maps (activePlayers and allConnections) in the WebSocket handler code. Update to the latest version of Podgrab if a patch is available.

Hi! I’m here to help you understand CVE-2026-104057. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70