CVE-2026-25791
Undergoing Analysis Undergoing Analysis - In Progress
Unauthenticated Session Allocation in Sliver DNS Listener Causes Memory Exhaustion

Publication date: 2026-02-09

Last updated on: 2026-02-23

Assigner: GitHub, Inc.

Description
Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to 1.7.0, the DNS C2 listener accepts unauthenticated TOTP bootstrap messages and allocates server-side DNS sessions without validating OTP values, even when EnforceOTP is enabled. Because sessions are stored without a cleanup/expiry path in this flow, an unauthenticated remote actor can repeatedly create sessions and drive memory exhaustion. This vulnerability is fixed in 1.7.0.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-09
Last Modified
2026-02-23
Generated
2026-06-16
AI Q&A
2026-02-09
EPSS Evaluated
2026-06-15
NVD
CVE-2026-25791
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
bishopfox sliver to 1.7.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

The vulnerability is fixed in Sliver version 1.7.0. Immediate mitigation involves upgrading Sliver to version 1.7.0 or later.

Executive Summary

This vulnerability exists in the Sliver command and control framework versions prior to 1.7.0. The DNS C2 listener accepts unauthenticated TOTP bootstrap messages and allocates server-side DNS sessions without validating the OTP values, even when the EnforceOTP feature is enabled.

Because these sessions are stored without any cleanup or expiry mechanism in this scenario, an unauthenticated remote attacker can repeatedly create sessions, which can lead to memory exhaustion on the server.

This issue was fixed in version 1.7.0 of Sliver.

Impact Analysis

An attacker exploiting this vulnerability can cause memory exhaustion on the server running the vulnerable Sliver framework by repeatedly creating unauthenticated DNS sessions.

This can lead to denial of service (DoS) conditions, potentially making the service unavailable or unstable.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-25791. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart