What is the CVSS score of CVE-2026-52857?

CVE-2026-52857 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-52857?

Yes, a patch is available for CVE-2026-52857. Update the affected software to the latest version immediately.

Pterodactyl Wings CVE-2026-52857

EUVD-2026-51567 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-07-31 security-advisories@github.com

GHSA-q6hh-gp44-4hcm

Denial Of Service Suse

5.5

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.5 MEDIUM

Local attack vector confirmed by file-write-based trigger; PR:L because game server tenant account is required; pure availability impact with no confidentiality or integrity effect.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jul 31, 2026 - 17:01 EUVD

Source Code Evidence Fetched

Jul 31, 2026 - 16:42 vuln.today

Analysis Generated

Jul 31, 2026 - 16:42 vuln.today

DescriptionCVE.org

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, unbounded json, yaml, and xml configuration-file parsers in parser.go can process an oversized non-file parser configuration file and exhaust Wings process memory. This issue is fixed in version 1.13.0.

AnalysisAI

Memory exhaustion via unbounded configuration file parsing in Pterodactyl Wings prior to v1.13.0 allows a low-privileged game server tenant to crash the Wings daemon. The parsers for JSON, YAML, XML, INI, and text configuration files in parser.go perform no size validation, enabling a malicious or oversized config file to buffer unlimited data into the Wings process heap and trigger an OOM kill. No public exploit is identified at time of analysis, and the vendor-released patch is available in v1.13.0.

Technical ContextAI

Wings is the Go-based server control plane (daemon) for the Pterodactyl open-source game server management panel. The root cause is CWE-400 (Uncontrolled Resource Consumption) in parser/parser.go, where format-specific parsers - JSON and text via io.ReadAll, YAML via bufio.Scanner, XML and INI via ini.Load - read entire configuration files into memory without enforcing any upper bound on file size. Since game server configuration files are tenant-owned input, an arbitrarily large file causes Wings to allocate unbounded heap until the OS OOM-kills the process. The fix in v1.13.0 introduces a 64 MB cap (maxConfigFileSize = 64 * 1024 * 1024), applied both as a pre-parse size check via file.Stat() and as io.LimitReader wrapping on all parser read paths, confirmed by commit 5f71f65711b6b9e6f913bec94a7b36d9a5eaae49.

RemediationAI

Upgrade Wings to v1.13.0 or later, available at https://github.com/pterodactyl/wings/releases/tag/v1.13.0. This release adds a 64 MB per-file cap enforced by io.LimitReader across all parsers and a pre-parse size check via file.Stat(), rendering oversized files harmless - Wings will refuse to rewrite them and log an error rather than buffer them. If immediate upgrade is not feasible, restrict game server tenants from placing or uploading arbitrarily large files into configuration directories that Wings egg parser settings reference; note this may block legitimate use cases for data-heavy game configs. As an additional compensating control, apply a systemd MemoryMax limit to the Wings service unit (e.g., MemoryMax=2G) so that an OOM event is bounded - this does not prevent the crash but limits collateral impact on the host. Advisory: https://github.com/pterodactyl/wings/security/advisories/GHSA-q6hh-gp44-4hcm.