CVE-2026-104057

HighCVSS 7.5

Published: 01/10/2026(UTC)Updated: 02/10/2026(UTC)Translated: 02/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

17th percentile - higher than 17% of all known CVEs

Summary

Podgrab contains an unauthenticated denial-of-service vulnerability caused by unsynchronized concurrent access to shared maps in its WebSocket handler. A remote attacker can open multiple WebSocket connections and send messages in a loop, causing a Go runtime data race that crashes the process, requiring operator intervention.

Risk Assessment

An attacker can cause service unavailability, requiring manual restart and potentially leading to downtime.

Recommendation

Upgrade Podgrab to a version with fixed map synchronization or apply mutexes.

Other vulnerabilities in Podgrab

CVE-2026-104058Medium
Podgrab contains a missing authentication vulnerability in which the /ws WebSocket route is registered on the root gin engine instead of the BasicAuth-protected router group, allowing unauthenticated network clients to connect even when PASSWORD is configured. Attackers can join the allConnections set, capture PlayerExists broadcasts containing client-supplied player identifiers, and replay them in a RegisterPlayer message to hijack queue payloads intended for authenticated users, exposing episode IDs, titles, and server-side file paths while potentially disrupting legitimate playback.

Original NVD description (English source)

Podgrab contains an unauthenticated denial-of-service vulnerability caused by unsynchronized concurrent access to shared maps (activePlayers and allConnections) in its WebSocket handler, where Wshandler and HandleWebsocketMessages goroutines read and write these maps without a mutex. A remote attacker can open multiple WebSocket connections to the /ws endpoint and send messages in a loop to trigger a Go runtime data race that crashes the process, causing a denial of service that requires operator intervention to restore service.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS