Executive brief
Pterodactyl Wings, the software responsible for managing and controlling game servers, is vulnerable to a denial-of-service attack. An attacker can send a specially crafted network packet during the file transfer (SFTP) login process to crash the service. This would result in the management panel becoming unavailable and potentially interrupting game server operations until the service is manually restarted.
Technical details
A vulnerability in the SFTP server component of Pterodactyl Wings (prior to version 1.13.0) allows for a remote denial-of-service. The flaw exists in the 'AcceptInbound' function within 'sftp/server.go', where the code attempts to slice the 'req.Payload' array without first verifying that the payload contains at least 4 bytes. An attacker sending a malformed packet with a payload smaller than 4 bytes triggers an out-of-bounds array index access, resulting in a Go runtime panic and service crash. This can be executed by an unauthenticated attacker over the network. The issue is resolved in version 1.13.0 by adding a length check before the slicing operation.
Affected products
- Pterodactyl Wings < 1.13.0
Timeline
- 2026-06-15: advisory: GitHub Security Advisory published
- 2026-06-15: patched: Version 1.13.0 released
- 2026-07-31: disclosed: NVD publication date