Skip to content
CVE PROGRAM SOURCE RECORD5.5 Medium

CVE-2026-52857

Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM

Description

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, unbounded json, yaml, and xml configuration-file parsers in parser.go can process an oversized non-file parser configuration file and exhaust Wings process memory. This issue is fixed in version 1.13.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

pterodactyl wings

  • < 1.13.0affected

References