pterodactyl/wings · Security
Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service
- GHSA ID
- GHSA-ghrq-5wpp-hxx5
- CVE ID
- CVE-2026-52856
- Severity
- high
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS v3
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
Summary
A maliciously crafted packet received & parsed during the SFTP connection handshake will cause a Go panic.
Impact
All wings users with an open SFTP port.
Workarounds
Close SFTP port.
CWEs
- CWE-20 · Improper Input Validation
- CWE-129 · Improper Validation of Array Index
- CWE-248 · Uncaught Exception
- CWE-400 · Uncontrolled Resource Consumption
- CWE-617 · Reachable Assertion
- CWE-755 · Improper Handling of Exceptional Conditions