{"id":"GHSA-q6hh-gp44-4hcm","revision":"145574acc15a494f8cc7a0535fd294f8","records":[{"revision":"145574acc15a494f8cc7a0535fd294f8","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-q6hh-gp44-4hcm","aliases":["CVE-2026-52857","GO-2026-6159"],"title":"Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM","description":"### Summary\nConfig file parsers, `json`, `yaml`, `xml` etc in parser.go have no file size limit/checks, allowing for a giant config file to potentially OOM the wings process.\n\n### Impact\nAll wings users who have an egg with a non-`file` parser configuration file setting.","state":0,"publishedAt":"2026-07-31T16:10:57+00:00","modifiedAt":"2026-08-18T15:10:42.4161642+00:00","affected":[{"ecosystem":"Go","name":"github.com/pterodactyl/wings","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.13.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/pterodactyl/wings/security/advisories/GHSA-q6hh-gp44-4hcm","https://github.com/pterodactyl/wings/commit/5f71f65711b6b9e6f913bec94a7b36d9a5eaae49","https://github.com/pterodactyl/wings","https://github.com/pterodactyl/wings/releases/tag/v1.13.0"],"sourceUrl":"https://github.com/advisories/GHSA-q6hh-gp44-4hcm","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-q6hh-gp44-4hcm","identifiers":["GHSA-q6hh-gp44-4hcm","CVE-2026-52857","GO-2026-6159"]},"retained":false,"historicalAffected":[]}],"coverage":[]}