CVE-2026-52856

Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SFTP connection handshake causes a Go panic. This issue is fixed in version 1.13.0.

Affected

pterodactyl · wings

EPSS

0.61% chance of exploitation in the next 30 days, 48th percentile

Published

2026-07-31

Proof-of-concept exploits (1)

• lisbickq/CVE-2026-52856-PoC

References

• CVE Record
• NVD entry