Is CVE-2026-52857 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-52857 being exploited in the wild.

How severe is CVE-2026-52857?

Medium severity, with a CVSS score of 5.5, published 31 July 2026.

Which products and versions are affected?

github.com/pterodactyl/wings (Go) < 1.13.0, SEMVER:introduced=0,fixed=1.13.0; Pterodactyl Wings < 1.13.0.

Is there a fix for CVE-2026-52857?

Yes. github.com/pterodactyl/wings (Go): upgrade to 1.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-52857 attacked?

It is attacked with local access, in a hosted service.

Am I affected by CVE-2026-52857?

Check whether you run github.com/pterodactyl/wings (Go) or Pterodactyl Wings at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52857: Pterodactyl Wings memory exhaustion in configuration file parsers

Q: Is there a fix for CVE-2026-52857?

Yes. github.com/pterodactyl/wings (Go): upgrade to 1.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-52857 attacked?

It is attacked with local access, in a hosted service.

Q: Am I affected by CVE-2026-52857?

Check whether you run github.com/pterodactyl/wings (Go) or Pterodactyl Wings at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52857 · Severity: medium · CVSS 5.5 · Published 2026-07-31

Pterodactyl Wings, the server control agent for the Pterodactyl game management panel, is vulnerable to a denial-of-service condition. An attacker or an erroneous configuration can provide an oversized configuration file that causes the Wings process to consume all available system memory and crash. This can lead to service outages for hosted game servers and management operations.

Technologies: github.com/pterodactyl/wings (Go), Pterodactyl Wings. Vendors: Go, Pterodactyl.

Quick answers

Is CVE-2026-52857 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-52857 being exploited in the wild.
How severe is CVE-2026-52857?: Medium severity, with a CVSS score of 5.5, published 31 July 2026.
Which products and versions are affected?: github.com/pterodactyl/wings (Go) < 1.13.0, SEMVER:introduced=0,fixed=1.13.0; Pterodactyl Wings < 1.13.0.
Is there a fix for CVE-2026-52857?: Yes. github.com/pterodactyl/wings (Go): upgrade to 1.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-52857 attacked?: It is attacked with local access, in a hosted service.
Am I affected by CVE-2026-52857?: Check whether you run github.com/pterodactyl/wings (Go) or Pterodactyl Wings at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/pterodactyl/wings (Go): upgrade to 1.13.0 or later
```
go get github.com/pterodactyl/wings@v1.13.0
```

Technical details

A resource exhaustion vulnerability exists in the `parser.go` component of Pterodactyl Wings. The configuration file parsers for formats such as JSON, YAML, and XML do not implement file size limits or validation checks before processing. A local attacker with low privileges can provide a maliciously crafted, excessively large configuration file, leading to an Out-of-Memory (OOM) condition that terminates the Wings process. This issue affects users utilizing 'eggs' with non-file parser configuration settings. The vulnerability is addressed in version 1.13.0.

Affected products

Pterodactyl Wings < 1.13.0

Identifiers

CVE-2026-52857
GHSA-q6hh-gp44-4hcm
GO-2026-6159

Timeline

2026-06-15: disclosed
2026-07-31: advisory
2026-07-31: patched: Fixed in version 1.13.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.