CVE-2026-52857: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM

July 31, 2026

Config file parsers, json, yaml, xml etc in parser.go have no file size limit/checks, allowing for a giant config file to potentially OOM the wings process.

References

github.com/advisories/GHSA-q6hh-gp44-4hcm
github.com/pterodactyl/wings/commit/5f71f65711b6b9e6f913bec94a7b36d9a5eaae49
github.com/pterodactyl/wings/releases/tag/v1.13.0
github.com/pterodactyl/wings/security/advisories/GHSA-q6hh-gp44-4hcm
nvd.nist.gov/vuln/detail/CVE-2026-52857

Code Behaviors & Features

Detect and mitigate CVE-2026-52857 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →