CVE-2026-104057

Name of the Vulnerable Software and Affected Versions Podgrab (affected versions not specified)

Description An unauthenticated denial-of-service issue exists due to unsynchronized concurrent access to shared maps activePlayers and allConnections within the WebSocket handler. The Wshandler and HandleWebsocketMessages goroutines read and write to these maps without using a mutex, which is a synchronization primitive used to prevent multiple threads from accessing shared data simultaneously. A remote attacker can trigger a Go runtime data race by opening multiple WebSocket connections to the '/ws' endpoint and sending messages in a loop, resulting in a process crash that requires operator intervention to restore service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.