Sliver
CVE-2026-25791
HIGH
GHSA-wxrw-gvg8-fqjp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend unauthenticated TOTP bootstrap message
-
DeliveryDNS C2 listener allocates server session
-
ExploitRepeated messages bypass OTP validation
-
ExecutionSessions accumulate without expiry
-
ImpactMemory exhaustion denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Sliver C2 DNS listener enabled and accepting TOTP bootstrap messages before version 1.7.0; EnforceOTP setting present but ineffective in DNS listener flow; no session cleanup/expiry mechanism implemented for this code path. |
| Impact | CVSS 7.5 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: None. Exploitation no authentication required. Exploitable via remote/network. Public exploit/POC available. |
| Exploit ScenarioDerived | A remote attacker without authentication could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Memory exhaustion in Sliver C2 framework prior to version 1.7.0 allows unauthenticated remote attackers to bypass OTP validation in the DNS listener and create unbounded server-side sessions without expiry mechanisms. Public exploit code exists for this vulnerability, enabling attackers to repeatedly allocate sessions and exhaust server memory resources. The DNS C2 listener accepts bootstrap messages without proper authentication even when OTP enforcement is enabled.
Earlier versions of this analysis (1)
Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to 1.7.0, the DNS C2 listener accepts unauthenticated TOTP bootstrap messages and allocates server-side DNS sessions without validating OTP values, even when EnforceOTP is enabled. [CVSS 7.5 HIGH]
RemediationAI
Fixed in version 1.7.0.. Restrict network access to the affected service where possible.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classified as CWE-306 (Missing Authentication for Critical Function). Affects Sliver. Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to 1.7.0, the DNS C2 listener accepts unauthenticated TOTP bootstrap messages and allocates server-side DNS sessions without validating OTP values, even when EnforceOTP is enabled. Because sessions are stored without a cleanup/expiry path in this flow, an unauthenticated remote actor can repeatedly create sessions and drive memory exhaustion. This vulnerability is fixed in 1.7.0.
Know when Sliver gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to 1.7.0, the DNS C2 listener accepts unauthenticated TOTP bootstrap messages and allocates server-side DNS sessions without validating OTP values, even when EnforceOTP is enabled. Because sessions are stored without a cleanup/expiry path in this flow, an unauthenticated remote actor can repeatedly create sessions and drive memory exhaustion. This vulnerability is fixed in 1.7.0.
Executive ViewAI
Sliver C2 framework deployments using DNS listeners are vulnerable to unauthenticated session hijacking, allowing attackers to bypass OTP security controls and establish command-and-control communications without proper authorization. Organizations relying on Sliver for security operations or threat emulation face immediate risk of unauthorized access and potential lateral movement within their infrastructure.
Disable DNS C2 listener entirely until patched version 1.7.0 is released and deployed. Implement network-layer controls: restrict DNS listener access to whitelisted IP addresses only; place Sliver infrastructure behind authenticated VPN or jump host; monitor and alert on unexpected DNS queries to C2 infrastructure; implement egress filtering to prevent command execution over DNS channels. Enable comprehensive logging of all DNS listener transactions for forensic analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Affected Products (CPE)GitHub Advisory
Sliver is an open source cross-platform adversary emulation/red team framework, it can be used by organizations of all s
Denial of service in Sliver C2 framework 1.7.7 and earlier allows an attacker who controls a compromised implant session
Authenticated operators in Sliver C2 framework versions prior to 1.6.11 can read arbitrary files on the server through a
Sliver from v1.5.x to v1.5.39 has an improper cryptographic implementation, which allows attackers to execute a man-in-t
Sliver C2 server versions 1.7.3 and earlier can be remotely crashed by authenticated attackers who craft malformed Proto
Unauthenticated attackers can hijack all active Sliver C2 sessions and beacons through a single malicious link clicked b
Vendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Exploit-DB