CVE-2026-52856

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SFTP connection handshake causes a Go panic. This issue is fixed in version 1.13.0...

CVE-2026-52856

Wings (server control plane for Pterodactyl) contains a vulnerability in which a malformed packet during the SFTP handshake can trigger a Go panic. This affects versions prior to 1.13.0. The issue is resolved in 1.13.0. Impact is described as a denial of service (Go panic) with a HIGH CVSS v3.1 b...

Fedora 22 : proftpd-1.3.5a-5.fc22 (2015-97055df8a0)

Part of the SFTP handshake involves 'extensions', which are key/value pairs, comprised of strings. In SSH, strings are encoded for network transport as a 32-bit length, followed by the bytes. The modsftp module currently places no bounds/length limitations when reading these SFTP extension...