The vulnerability lies in Wings’ unbounded JSON, YAML, and XML configuration‑file parsers. A malformed or excessively large configuration file can force the Wings process to allocate memory until it is exhausted, resulting in a crash or unresponsiveness. This flaw falls under CWE‑400, which denotes Uncontrolled Resource Consumption. The primary impact is a denial of service that prevents the Wings process from handling legitimate requests, potentially affecting all game servers managed by the panel.

The flaw affects Pterodactyl Wings versions released before 1.13.0. Any installation that has not been upgraded to version 1.13.0 or later remains vulnerable. This includes all deployments that rely on the default configuration‑file parsing code in parser.go.

The CVSS score of 5.5 indicates a medium‑severity resource‑exhaustion risk. With an EPSS score of less than 1% the likelihood of a publicly available exploit is low, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to involve an attacker with the ability to create or modify configuration files that Wings processes; by supplying an oversized file the attacker can induce an out‑of‑memory condition. Because the exploitation requires only file‑level access and no elevated privileges, the launch cost is modest, but the impact on service availability can be significant for production deployments.