Description

Podgrab contains an unauthenticated denial-of-service vulnerability caused by unsynchronized concurrent access to shared maps (activePlayers and allConnections) in its WebSocket handler, where Wshandler and HandleWebsocketMessages goroutines read and write these maps without a mutex. A remote attacker can open multiple WebSocket connections to the /ws endpoint and send messages in a loop to trigger a Go runtime data race that crashes the process, causing a denial of service that requires operator intervention to restore service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-10-01T19:17:19.160Z",
  "pubdate": "2026-10-01T19:17:19.160Z",
  "executiveSummary": "Podgrab is vulnerable to an unauthenticated denial-of-service (DoS) condition stemming from improper concurrency control within its WebSocket management logic.\nThe vulnerability arises from unsynchronized concurrent access to shared data structures—specifically the activePlayers and allConnections maps—by the Wshandler and HandleWebsocketMessages goroutines.\nThis lack of synchronization leads to a Go runtime data race, which results in an immediate and unrecoverable process crash.\nA remote, unauthenticated attacker can exploit this by opening multiple concurrent WebSocket connections to the /ws endpoint and flooding the server with messages.\nThe exploitation does not require special privileges or pre-existing authentication, significantly lowering the barrier for impact.\nThe primary risk implication is service unavailability, requiring manual operator intervention to restore functionality after the runtime panic.\nThis issue highlights a critical deficiency in thread-safe state management within the application's networking stack, rendering the service susceptible to trivial disruption by external actors over the network.",
  "technicalDetails": "The root cause of this vulnerability is a race condition triggered by the absence of synchronization primitives, such as sync.RWMutex or sync.Mutex, when accessing globally scoped maps named activePlayers and allConnections.\nIn the Go programming environment, maps are not inherently thread-safe for concurrent read and write operations. When multiple goroutines attempt to modify or read these shared maps simultaneously, the Go runtime triggers a fatal error, specifically a concurrent map access panic, which terminates the entire process.\nThe vulnerable components are the Wshandler and HandleWebsocketMessages functions. These functions are responsible for managing the lifecycle and message processing for WebSocket clients. Under normal execution, the application spawns new goroutines to handle incoming traffic, but it fails to ensure that mutations to the internal player and connection registries are atomic.\nThe exploitation flow proceeds as follows: First, an unauthenticated attacker initiates multiple concurrent WebSocket connections to the /ws protocol endpoint. Second, the attacker transmits a rapid series of messages across these established channels. This forces the application to spawn and execute competing goroutines that attempt to insert, update, or read from the shared maps without any locking mechanism.\nBecause these operations occur in a non-deterministic execution order, a collision is statistically guaranteed when the volume of concurrent requests is sufficient. Once the Go scheduler triggers concurrent access, the runtime detects the unsafe memory operation and intentionally crashes the Podgrab binary to prevent potential memory corruption, effectively achieving a persistent denial-of-service state.\nThe attack is network-exposed as it targets the public-facing /ws WebSocket interface. There are no authentication requirements, and the exploit does not require escalated privileges, as the panic occurs at the runtime level during the initial handshake and message processing phases. Post-exploitation, the service remains non-functional until a restart is performed, which may be automated but does not prevent repeated cycles of downtime if the attacker continues to send malicious traffic."
}