{"id":"GHSA-ghrq-5wpp-hxx5","revision":"793e44a070e74360b94bf60df9727319","records":[{"revision":"793e44a070e74360b94bf60df9727319","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-ghrq-5wpp-hxx5","aliases":["CVE-2026-52856","GO-2026-6156"],"title":"Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service","description":"### Summary\nA maliciously crafted packet received & parsed during the SFTP connection handshake will cause a Go panic.\n\n### Impact\nAll wings users with an open SFTP port.\n\n### Workarounds\nClose SFTP port.","state":0,"publishedAt":"2026-07-31T16:20:25+00:00","modifiedAt":"2026-08-18T15:10:34.947262+00:00","affected":[{"ecosystem":"Go","name":"github.com/pterodactyl/wings","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.13.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/pterodactyl/wings/security/advisories/GHSA-ghrq-5wpp-hxx5","https://github.com/pterodactyl/wings/commit/8e49c7c0eda815d3ada171831876a1c14c493026","https://github.com/pterodactyl/wings","https://github.com/pterodactyl/wings/releases/tag/v1.13.0"],"sourceUrl":"https://github.com/advisories/GHSA-ghrq-5wpp-hxx5","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-ghrq-5wpp-hxx5","identifiers":["GHSA-ghrq-5wpp-hxx5","CVE-2026-52856","GO-2026-6156"]},"retained":false,"historicalAffected":[]}],"coverage":[]}