Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service

높음 7.5CVE-2026-52856 · GHSA-ghrq-5wpp-hxx5 · GO-2026-6156 · Published 31/07/2026 · updated 23/10/2026

요약

CVE-2026-52856은(는) github.com/pterodactyl/wings에 영향을 주는 높음 (CVSS 7.5) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.61%, 전체 취약점의 49.2%보다 높음.
조치: 1.13.0 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
github.com/pterodactyl/wings Go	`< 1.13.0`	`1.13.0`

Description

Summary

A maliciously crafted packet received & parsed during the SFTP connection handshake will cause a Go panic.

Impact

All wings users with an open SFTP port.

Workarounds

Close SFTP port.

NVD description

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SFTP connection handshake causes a Go panic. This issue is fixed in version 1.13.0.

References

pterodactyl/wings security advisory · WEB
pterodactyl/wings commit 8e49c7c · WEB
pterodactyl/wings · PACKAGE
pterodactyl/wings release v1.13.0 · WEB

github.com/pterodactyl/wings의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/pterodactyl/wings

< 1.13.0

1.13.0

Description

Summary

A maliciously crafted packet received & parsed during the SFTP connection handshake will cause a Go panic.

Impact

All wings users with an open SFTP port.

Workarounds

Close SFTP port.

NVD description

github.com/pterodactyl/wings의 다른 취약점

모두 보기 →