CVE-2026-52857: Wings Pterodactyl DoS Vulnerability

CVE-2026-52857 Overview

CVE-2026-52857 is a resource exhaustion vulnerability in Pterodactyl Wings, the server control plane for the Pterodactyl open-source game server management panel. Versions prior to 1.13.0 contain unbounded JSON, YAML, and XML configuration-file parsers in parser.go. An authenticated local actor can supply an oversized non-file parser configuration file that the parser loads entirely into memory. The parser has no upper bound on input size, causing the Wings process to consume all available memory and terminate. The issue is classified under CWE-400 (Uncontrolled Resource Consumption). Version 1.13.0 resolves the flaw by introducing a 64 MB cap on configuration files.

Critical Impact
A local user with server configuration privileges can exhaust Wings process memory, disrupting all game servers managed by the affected daemon.

Affected Products

Pterodactyl Wings versions prior to 1.13.0
Pterodactyl panel deployments using vulnerable Wings daemons
Game server hosting environments relying on Wings for orchestration

Discovery Timeline

2026-07-31 - CVE-2026-52857 published to NVD
2026-07-31 - Last updated in NVD database
Fix released - Pterodactyl Wings v1.13.0 published on GitHub with parser size limits

Technical Details for CVE-2026-52857

Vulnerability Analysis

Wings uses the parser.go module to process configuration files for game servers. The parser supports several formats including JSON, YAML, and XML, and delegates parsing to standard library and third-party decoders. Prior to version 1.13.0, the code path for non-file parser types read the entire configuration payload into memory without enforcing a size limit. When a user submitted an oversized file, the decoders allocated proportional buffers and intermediate structures. This behavior mapped directly onto process memory, producing an out-of-memory condition on the host running Wings. Because Wings coordinates all game server containers on a node, its termination cascades into service loss for every tenant on that node. The vulnerability requires local access with low privileges, and no user interaction is needed to trigger the parsing path.

Root Cause

The root cause is the absence of a maximum size constant governing configuration ingestion in parser/parser.go. The file parser used maxTextScanTokenSize (64 MB) to bound line buffering, but the JSON, YAML, and XML paths had no equivalent guard. Decoder libraries allocated memory in proportion to input size, allowing a small uploaded artifact to expand into gigabytes of resident memory.

Attack Vector

Exploitation requires a local, authenticated actor with permission to submit a parser configuration file to Wings. The actor supplies a large JSON, YAML, or XML document. Wings loads the document through the vulnerable parser path, allocates memory to hold the parsed representation, and exhausts available RAM. The Linux OOM killer or the Go runtime then terminates the Wings process.

 // maxTextScanTokenSize bounds how large a single line the "file" parser will buffer.
 const maxTextScanTokenSize = 64 * 1024 * 1024
 
+// maxConfigFileSize caps how large a configuration file we'll attempt to parse.
+const maxConfigFileSize = 64 * 1024 * 1024
+
 type ReplaceValue struct {
 	value     []byte
 	valueType jsonparser.ValueType

Source: Pterodactyl Wings commit 5f71f65 — the patch adds a maxConfigFileSize constant that caps configuration payloads at 64 MB before parsing.

Detection Methods for CVE-2026-52857

Indicators of Compromise

Wings daemon terminating unexpectedly with out-of-memory signals in dmesg or systemd journal entries.
Sudden spikes in resident memory attributable to the wings process immediately following a configuration submission.
Repeated container restarts across multiple game servers on the same host without a corresponding workload change.

Detection Strategies

Monitor process-level memory metrics for the Wings binary and alert when RSS exceeds a defined baseline within a short window.
Correlate Wings API access logs for parser configuration submissions with subsequent daemon crashes.
Track kernel OOM killer events targeting wings in /var/log/kern.log or the systemd journal.

Monitoring Recommendations

Ingest Wings application logs and host telemetry into a central log platform for correlation with authentication events.
Alert on abnormally large HTTP payloads reaching Wings endpoints handling parser configurations.
Baseline expected Wings memory consumption per node and trigger notifications on statistical deviations.

How to Mitigate CVE-2026-52857

Immediate Actions Required

Upgrade Pterodactyl Wings to version 1.13.0 or later on every node in the deployment.
Restrict which users and API tokens can submit parser configuration files to Wings.
Apply operating system resource limits to the Wings process to contain any residual memory exhaustion attempts.

Patch Information

The fix ships in Pterodactyl Wings v1.13.0. The change, tracked in GHSA-q6hh-gp44-4hcm, introduces maxConfigFileSize = 64 * 1024 * 1024, capping configuration payloads at 64 MB before JSON, YAML, or XML decoding.

Workarounds

Enforce a reverse-proxy request-size limit in front of Wings to reject oversized uploads before they reach the parser.
Apply systemdMemoryMax= or cgroup memory limits to the Wings service so exhaustion attempts trigger contained restarts rather than host-wide impact.
Audit and reduce the set of accounts holding server-modification privileges until patching completes.

bash

# Example systemd override to bound Wings memory usage
sudo systemctl edit wings.service

[Service]
MemoryMax=2G
MemoryHigh=1500M
Restart=on-failure