Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM

보통 5.5CVE-2026-52857 · GHSA-q6hh-gp44-4hcm · GO-2026-6159 · Published 31/07/2026 · updated 23/10/2026

요약

CVE-2026-52857은(는) github.com/pterodactyl/wings에 영향을 주는 보통 (CVSS 5.5) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.16%, 전체 취약점의 5.2%보다 높음.
조치: 1.13.0 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
github.com/pterodactyl/wings Go	`< 1.13.0`	`1.13.0`

Description

Summary

Config file parsers, json, yaml, xml etc in parser.go have no file size limit/checks, allowing for a giant config file to potentially OOM the wings process.

Impact

All wings users who have an egg with a non-file parser configuration file setting.

NVD description

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, unbounded json, yaml, and xml configuration-file parsers in parser.go can process an oversized non-file parser configuration file and exhaust Wings process memory. This issue is fixed in version 1.13.0.

References

pterodactyl/wings security advisory · WEB
pterodactyl/wings commit 5f71f65 · WEB
pterodactyl/wings · PACKAGE
pterodactyl/wings release v1.13.0 · WEB

github.com/pterodactyl/wings의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/pterodactyl/wings

< 1.13.0

1.13.0

Description

Summary

Config file parsers, json, yaml, xml etc in parser.go have no file size limit/checks, allowing for a giant config file to potentially OOM the wings process.

Impact

All wings users who have an egg with a non-file parser configuration file setting.

NVD description

github.com/pterodactyl/wings의 다른 취약점

모두 보기 →