https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T18:19:45.988799+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-343365 EUVD-2026-343365 2026-10-05T18:19:46.172881+00:00 EUVD-2026-343365 https://cve.radiocsirt.org/vuln/fkie_cve-2026-52857 fkie_cve-2026-52857 2026-10-05T18:19:46.172938+00:00

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, unbounded json, yaml, and xml configuration-file parsers in parser.go can process an oversized non-file parser configuration file and exhaust Wings process memory. This issue is fixed in version 1.13.0.

 https://cve.radiocsirt.org/vuln/ghsa-q6hh-gp44-4hcm GHSA-q6hh-gp44-4hcm — Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM 2026-10-05T18:19:46.172973+00:00

Affected: Go: github.com/pterodactyl/wings

### Summary Config file parsers, `json`, `yaml`, `xml` etc in parser.go have no file size limit/checks, allowing for a giant config file to potentially OOM the wings process.

### Impact All wings users who have an egg with a non-`file` parser configuration file setting.