CVE-2026-52857
published 2026-07-31CVE-2026-52857: Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, unbounded json, yaml, and xml…
PriorityP425medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.11%
1.6th percentile
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, unbounded json, yaml, and xml configuration-file parsers in parser.go can process an oversized non-file parser configuration file and exhaust Wings process memory. This issue is fixed in version 1.13.0.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | pterodactyl_wings | >= 0 < 1.13.0 | 1.13.0 |
| pterodactyl | wings | < 1.13.0 | 1.13.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Pterodactyl Wings prior 1.13.0 Configuration File Parser parser.go resource consumption (EUVD-2026-51567)
vuldb·2026-07-31·CVSS 5.5
CVE-2026-52857 [MEDIUM] Pterodactyl Wings prior 1.13.0 Configuration File Parser parser.go resource consumption (EUVD-2026-51567)
A vulnerability classified as problematic was found in Pterodactyl Wings prior 1.13.0. Affected is an unknown function of the file parser.go of the component Configuration File Parser. The manipulation results in resource consumption.
This vulnerability was named CVE-2026-52857. The attack may be performed from remote. There is no available exploit.
GHSA
Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM
ghsa·2026-07-31
CVE-2026-52857 [MEDIUM] CWE-400 Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM
Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM
### Summary
Config file parsers, `json`, `yaml`, `xml` etc in parser.go have no file size limit/checks, allowing for a giant config file to potentially OOM the wings process.
### Impact
All wings users who have an egg with a non-`file` parser configuration file setting.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-31
Published