CVE-2026-52857

MEDIUM

Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM

Title source: cna
STIX 2.1

Description

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, unbounded json, yaml, and xml configuration-file parsers in parser.go can process an oversized non-file parser configuration file and exhaust Wings process memory. This issue is fixed in version 1.13.0.

References (3)

Core 3

Scores

CVSS v3 5.5
EPSS 0.0011
EPSS Percentile 1.6%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-400
Status published
Products (2)
pterodactyl/wings 0 - 1.13.0Go
pterodactyl/wings < 1.13.0
Published Jul 31, 2026
Tracked Since Jul 31, 2026