github.com/BishopFox/sliver

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

1. High, CVSS 8.2GoAmendedPublished 15 Oct 2026

   Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder

   CVE-2026-77622 · GHSA-663m-7x7m-g4fw

   Affected

   • Go github.com/BishopFox/sliver < 1.7.6

   Fixed in

   1.7.6· Vendor fix available

   Issue

   Sliver is vulnerable to a Denial of Service (DOS) attack because there is no cap in the size of a PNG file that can be sent to an open http listener and there is a small amount of possible nonces. This vulnerability lets the attacker completely max out the RAM of the machine running server, leading to a complete loss of availability. Details The first vulnerability is that the amount of possible nonces is 65,537. This is found in server/encoders/encoders.go The second vulnerability is there is no limit to how many pixels the PNG encoder will accept from an unauthenticated user. This is found in: util/encoders/images.go PoC The first step to reproduce this vulnerability is building a docker container to make sure no harm is caused. Get the latest version of Sliver (Currently 1.7.3) Build the Docker container: Run the Docker container with a memory cap for example 4GB: After the Docker container starts, create an http listener on port 8080: In a seperate terminal create the…

   Recommended action: Upgrade to 1.7.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

   Sources:osv.dev (1)osv.dev (2)github.com (3)Source checked 26 Oct 2026, 15:32 UTCEvidence →
2. High, CVSS 7.7GoPublished 25 Feb 2026

   Sliver has Potential Zip Bomb Denial of Service in GzipEncoder

   GHSA-2phg-qgmm-r638

   Affected

   • Go github.com/BishopFox/sliver < 1.7.2

   Fixed in

   1.7.2· Vendor fix available

   Issue

   GzipEncoder does not limit output size when processing compressed data. This allows unauthenticated remote attackers to crash sliver server by sending a http request with highly compressed gzip data (aka zip bomb). Details In util/encoders/gzip.go, Decode() method decompresses given data by reading the entire gzip buffer at once without limiting output size. PoC Impact Unauthenticated remote attackers can exhaust memory and cpu resource of sliver server and crash it when they have GzipEncoderID, which can be easily retrived from implant's http traffic, or by brute-forcing. A fixed version is available at https://github.com/BishopFox/sliver/releases/tag/v1.7.2.

   Recommended action: Upgrade to 1.7.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

   Sources:github.comSource checked 26 Oct 2026, 15:14 UTCEvidence →