CVE-2026-52856

HIGH

Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service

Title source: cna
STIX 2.1

Description

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SFTP connection handshake causes a Go panic. This issue is fixed in version 1.13.0.

References (3)

Core 3

Scores

CVSS v3 7.5
EPSS 0.0034
EPSS Percentile 26.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-129 CWE-248 CWE-617 CWE-755
Status published
Products (2)
pterodactyl/wings 0 - 1.13.0Go
pterodactyl/wings < 1.13.0
Published Jul 31, 2026
Tracked Since Jul 31, 2026