CVE-2026-52857

mediumCVSS 5.5covered by 2 sourcesfirst seen 2026-07-31

Summary Config file parsers, json, yaml, xml etc in parser.go have no file size limit/checks, allowing for a giant config file to potentially OOM the wings process. Impact All wings users who have an egg with a non-file parser configuration file setting.

⚡ Watch CVE-2026-52857

Get an email if CVE-2026-52857 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (2)

mediumCVE-2026-52857: Wings is the server control plane for Pterodactyl, a free, open-source game server management …nvd · 2026-07-31
mediumGHSA-q6hh-gp44-4hcm: Wings: Maliciously or erroneously created parsed config files can cause wings process to …ghsa · 2026-07-31

External references

NVD record for CVE-2026-52857

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-52857 status](https://www.csirts.com/badge/CVE-2026-52857)](https://www.csirts.com/cve/CVE-2026-52857)