In short
- CVE-2026-25791 is a HIGH (CVSS 7.5) vulnerability affecting github.com/bishopfox/sliver, sliver (bishopfox).
- Chance of exploitation in the next 30 days (EPSS): 0.45%, higher than 39.5% of all vulnerabilities.
- Fix: update to 1.6.12, 1.7.0 or later.
Description
Summary
The DNS C2 listener accepts unauthenticated TOTP bootstrap messages and allocates server-side DNS sessions without validating OTP values, even when EnforceOTP is enabled. Because sessions are stored without a cleanup/expiry path in this flow, an unauthenticated remote actor can repeatedly create sessions and drive memory exhaustion.
Vulnerable Component
server/c2/dns.go:84-90 (EnforceOTP stored but not enforced in bootstrap)server/c2/dns.go:378-390 (TOTP requests routed directly to bootstrap)server/c2/dns.go:490-521 (handleHello allocates session without OTP validation)server/c2/dns.go:495 (sessions.Store with no lifecycle control in this path)client/command/jobs/dns.go:46-52 (operator-facing EnforceOTP control implies auth gate)implant/sliver/transports/dnsclient/dnsclient.go:896-900 (otpMsg sends TOTP with ID=0)protobuf/dnspb/dns.proto:22 (documents TOTP in ID field)
Attack Vector
- Network-accessible DNS listener
- No authentication required
- Low-complexity repeated DNS query loop
- Trigger path:
DNSMessageType_TOTP bootstrap handling
Proof of Concept
Preconditions
- DNS listener is reachable
- DNS C2 job is active
Reproduction Steps
- Send repeated DNS queries with a minimal protobuf message of type
TOTP.
- Observe repeated session allocation/issuance behavior.
- Continue requests to increase active in-memory session state.
Example
while true; do
dig +short @<DNS_C2_IP> baa8.<parent-domain> A >/dev/null
done
baa8 is a base32 payload for a minimal TOTP-type protobuf message.
Observable Indicators
- Repeated bootstrap/session-allocation log entries from
handleHello
- Rising memory usage in the Sliver server process
- Service slowdown or instability under sustained request volume
Impact
- Unauthenticated remote denial of service (availability)
- Resource exhaustion through unbounded session growth in DNS bootstrap path
- Estimated CVSS v3.1:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5 High)
NVD description
Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to 1.7.0, the DNS C2 listener accepts unauthenticated TOTP bootstrap messages and allocates server-side DNS sessions without validating OTP values, even when EnforceOTP is enabled. Because sessions are stored without a cleanup/expiry path in this flow, an unauthenticated remote actor can repeatedly create sessions and drive memory exhaustion. This vulnerability is fixed in 1.7.0.
More vulnerabilities in github.com/bishopfox/sliver
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free