Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service

HIGH 7.5CVE-2026-52856 · GHSA-ghrq-5wpp-hxx5 · GO-2026-6156 · Published 31/07/2026 · updated 23/10/2026

Package	Affected versions	Patched versions
github.com/pterodactyl/wings Go	`< 1.13.0`	`1.13.0`

Description

Summary

A maliciously crafted packet received & parsed during the SFTP connection handshake will cause a Go panic.

Impact

All wings users with an open SFTP port.

Workarounds

Close SFTP port.

NVD description

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SFTP connection handshake causes a Go panic. This issue is fixed in version 1.13.0.

References

pterodactyl/wings security advisory · WEB
pterodactyl/wings commit 8e49c7c · WEB
pterodactyl/wings · PACKAGE
pterodactyl/wings release v1.13.0 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free