CVE-2026-77622
Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Sliver is a command and control framework. Prior to 1.7.6, an HTTP(S) listener using the PNG encoder accepts attacker-controlled PNG dimensions without an effective decoded-size or pixel limit in util/encoders/images.go, while the listener nonce space implemented in server/encoders/encoders.go is small enough to search remotely. An unauthenticated attacker who identifies a valid nonce can submit a highly compressed image to PNGEncoder.Decode, where it expands during png.Decode, exhausting server memory and causing a complete loss of availability. This vulnerability is fixed in 1.7.6.
| CWE | CWE-770 |
| Vendor | bishopfox |
| Product | sliver |
| Published | Nov 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for bishopfox sliver
Be the first to know when new unknown vulnerabilities affecting bishopfox sliver are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
BishopFox / sliver
< 1.7.6