PT-2026-6434 · Go · Github.Com/Bishopfox/Sliver

Published 2026-01-05 · Updated 2026-01-05

OSV

CVSS v4.0

5.5

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

Summary

A specially crafted nonce routes unauthenticated requests through the NoEncoder path, where startSessionHandler() reads the entire request body without limits, allowing attacker-driven memory exhaustion and process crash.

Details

• server/encoders/encoders.go: EncoderFromNonce() returns NoEncoder when nonce % 65537 == 0 (lines 254-264); NoEncoder is a passthrough (util/encoders/nop.go:22-32).
• server/c2/http.go: anonymousHandler() routes requests with any encoder (including NoEncoder) to startSessionHandler() (lines 551-562).
• server/c2/http.go: startSessionHandler() uses io.ReadAll(req.Body) without a size cap (lines 564-643), unlike the authenticated path that uses io.LimitedReader (readReqBody(), lines 708-732).

PoC

An attacker could send an HTTP POST with a nonce that is a multiple of 65537 (e.g., ?q=65537) so it is handled by startSessionHandler() with a NoEncoder, and advertise a very large Content-Length while streaming data. Because this handler uses io.ReadAll(req.Body) without a size limit, the server is expected to allocate large amounts of memory and may exhaust available RAM, leading to process termination on typical deployments.

Impact

Unauthenticated remote DoS: attacker can crash the Sliver HTTP listener, dropping all active sessions and locking out operators until restart. No credentials or non-default config required.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

GHSA-HJR9-WJ7V-7HV8

Affected Products

Github.Com/Bishopfox/Sliver

References · 3

• https://osv.dev/vulnerability/GHSA-hjr9-wj7v-7hv8 · Vendor Advisory
• https://github.com/BishopFox/sliver · Note
• https://github.com/BishopFox/sliver/security/advisories/GHSA-hjr9-wj7v-7hv8 · Note