CVE-2026-52857: Pterodactyl Wings memory exhaustion in configuration file parsers

Executive brief

Pterodactyl Wings, the server control agent for the Pterodactyl game management panel, is vulnerable to a denial-of-service condition. An attacker or an erroneous configuration can provide an oversized configuration file that causes the Wings process to consume all available system memory and crash. This can lead to service outages for hosted game servers and management operations.

Technical details

A resource exhaustion vulnerability exists in the `parser.go` component of Pterodactyl Wings. The configuration file parsers for formats such as JSON, YAML, and XML do not implement file size limits or validation checks before processing. A local attacker with low privileges can provide a maliciously crafted, excessively large configuration file, leading to an Out-of-Memory (OOM) condition that terminates the Wings process. This issue affects users utilizing 'eggs' with non-file parser configuration settings. The vulnerability is addressed in version 1.13.0.

Affected products

• Pterodactyl Wings < 1.13.0

Timeline

• 2026-06-15: disclosed
• 2026-07-31: advisory
• 2026-07-31: patched: Fixed in version 1.13.0

References

• https://api.github.com/users/WilliamVenner
• https://github.com/WilliamVenner
• https://api.github.com/users/WilliamVenner/gists%7B/gist_id%7D
• https://api.github.com/users/WilliamVenner/repos
• https://avatars.githubusercontent.com/u/14863743?v=4
• https://api.github.com/users/WilliamVenner/events%7B/privacy%7D