{"id":"GHSA-q6hh-gp44-4hcm","summary":"Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM","details":"### Summary\nConfig file parsers, `json`, `yaml`, `xml` etc in parser.go have no file size limit/checks, allowing for a giant config file to potentially OOM the wings process.\n\n### Impact\nAll wings users who have an egg with a non-`file` parser configuration file setting.","aliases":["CVE-2026-52857","GO-2026-6159"],"modified":"2026-08-18T15:10:42.416164248Z","published":"2026-07-31T16:10:57Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-07-31T16:10:57Z","nvd_published_at":null,"cwe_ids":["CWE-400","CWE-770","CWE-789"]},"references":[{"type":"WEB","url":"https://github.com/pterodactyl/wings/security/advisories/GHSA-q6hh-gp44-4hcm"},{"type":"WEB","url":"https://github.com/pterodactyl/wings/commit/5f71f65711b6b9e6f913bec94a7b36d9a5eaae49"},{"type":"PACKAGE","url":"https://github.com/pterodactyl/wings"},{"type":"WEB","url":"https://github.com/pterodactyl/wings/releases/tag/v1.13.0"}],"affected":[{"package":{"name":"github.com/pterodactyl/wings","ecosystem":"Go","purl":"pkg:golang/github.com/pterodactyl/wings"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.13.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-q6hh-gp44-4hcm/GHSA-q6hh-gp44-4hcm.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}