CVE-2026-52856: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service

July 31, 2026

A maliciously crafted packet received & parsed during the SFTP connection handshake will cause a Go panic.

References

github.com/advisories/GHSA-ghrq-5wpp-hxx5
github.com/pterodactyl/wings/commit/8e49c7c0eda815d3ada171831876a1c14c493026
github.com/pterodactyl/wings/releases/tag/v1.13.0
github.com/pterodactyl/wings/security/advisories/GHSA-ghrq-5wpp-hxx5
nvd.nist.gov/vuln/detail/CVE-2026-52856

Code Behaviors & Features

Detect and mitigate CVE-2026-52856 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →