CVE-2026-25791

Undergoing Analysis Undergoing Analysis - In Progress

Unauthenticated Session Allocation in Sliver DNS Listener Causes Memory Exhaustion

Publication date: 2026-02-09

Last updated on: 2026-02-23

Assigner: GitHub, Inc.

Description

Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to 1.7.0, the DNS C2 listener accepts unauthenticated TOTP bootstrap messages and allocates server-side DNS sessions without validating OTP values, even when EnforceOTP is enabled. Because sessions are stored without a cleanup/expiry path in this flow, an unauthenticated remote actor can repeatedly create sessions and drive memory exhaustion. This vulnerability is fixed in 1.7.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-02-09

Last Modified

2026-02-23

Generated

2026-07-06

AI Q&A

2026-02-09

EPSS Evaluated

2026-07-05

NVD

CVE-2026-25791

Affected Vendors & Products

Vendor	Product	Version / Range
bishopfox	sliver	to 1.7.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Mitigation Strategies

The vulnerability is fixed in Sliver version 1.7.0. Immediate mitigation involves upgrading Sliver to version 1.7.0 or later.

Compliance Impact

I don't know

Detection Guidance

I don't know

Executive Summary

This vulnerability exists in the Sliver command and control framework versions prior to 1.7.0. The DNS C2 listener accepts unauthenticated TOTP bootstrap messages and allocates server-side DNS sessions without validating the OTP values, even when the EnforceOTP feature is enabled.

Because these sessions are stored without any cleanup or expiry mechanism in this scenario, an unauthenticated remote attacker can repeatedly create sessions, which can lead to memory exhaustion on the server.

This issue was fixed in version 1.7.0 of Sliver.

Impact Analysis

An attacker exploiting this vulnerability can cause memory exhaustion on the server running the vulnerable Sliver framework by repeatedly creating unauthenticated DNS sessions.

This can lead to denial of service (DoS) conditions, potentially making the service unavailable or unstable.

Hi! I’m here to help you understand CVE-2026-25791. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70