Vulnerability · Published Nov 5, 2026 · Assigned by GitHub_M
CVE-2026-77622Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder
High 8.2
In plain English
A high-severity resource allocation without limits in sliver from BishopFox. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Sliver is a command and control framework. Prior to 1.7.6, an HTTP(S) listener using the PNG encoder accepts attacker-controlled PNG dimensions without an effective decoded-size or pixel limit in util/encoders/images.go, while the listener nonce space implemented in server/encoders/encoders.go is small enough to search remotely. An unauthenticated attacker who identifies a valid nonce can submit a highly compressed image to PNGEncoder.Decode, where it expands during png.Decode, exhausting server memory and causing a complete loss of availability. This vulnerability is fixed in 1.7.6.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/BishopFox/sliver | 1.7.6 | GHSA-663m-7x7m-g4fw |
| Go | github.com/bishopfox/sliver | 1.7.6 | GO-2026-6777 |
Affected products (as reported)
Weakness: CWE-770 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
References
- https://github.com/BishopFox/sliver/security/advisories/GHSA-663m-7x7m-g4fw x_refsource_CONFIRM
- https://github.com/BishopFox/sliver/commit/80273462bd8b2a3cd724d2d6d0301a0cabfa977d x_refsource_MISC
- https://github.com/BishopFox/sliver/releases/tag/v1.7.6 x_refsource_MISC