PT-2026-66779 · Wings · Wings

CVE-2026-52857 · Published 2026-07-31 · Updated 2026-07-31

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Wings versions prior to 1.13.0

Description Unbounded configuration-file parsers for json, yaml, and xml within parser.go lack file size limits or checks. This allows the processing of oversized non-file parser configuration files, which can lead to the exhaustion of process memory and cause an Out-of-Memory (OOM) condition, where the system terminates the process because it has run out of available memory.

Recommendations Update to version 1.13.0.

Fix

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

CWE-789

Related Identifiers

CVE-2026-52857

GHSA-Q6HH-GP44-4HCM

Affected Products

Wings

References · 6

• https://osv.dev/vulnerability/GHSA-q6hh-gp44-4hcm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-52857 · Security Note
• https://github.com/pterodactyl/wings · Note
• https://github.com/pterodactyl/wings/releases/tag/v1.13.0 · Note
• https://github.com/pterodactyl/wings/security/advisories/GHSA-q6hh-gp44-4hcm · Note
• https://github.com/pterodactyl/wings/commit/5f71f65711b6b9e6f913bec94a7b36d9a5eaae49 · Note