PT-2026-6972 · Sliver · Sliver

Xtle0O0 · Published 2026-02-06 · Updated 2026-03-18 · CVE-2026-25791

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Sliver versions prior to 1.7.0

Description The DNS command and control (C2) listener accepts unauthenticated Time-based One-Time Password (TOTP) bootstrap messages and allocates server-side DNS sessions without validating the OTP values, even when EnforceOTP is enabled. Sessions are stored indefinitely in this flow, allowing an unauthenticated remote actor to repeatedly create sessions and exhaust server memory. The vulnerable code resides in server/c2/dns.go (lines 84-90, 378-390, 490-521), client/command/jobs/dns.go (lines 46-52), implant/sliver/transports/dnsclient/dnsclient.go (lines 896-900), and protobuf/dnspb/dns.proto (line 22). The attack vector involves sending repeated DNS queries with a minimal protobuf message of type TOTP to the network-accessible DNS listener. The DNSMessageType TOTP bootstrap handling path is the trigger. This can lead to an unauthenticated remote denial of service through resource exhaustion.

Recommendations Versions prior to 1.7.0 should be updated to version 1.7.0 or later.

Exploit

Fix

DoS

Resource Exhaustion

Missing Authentication

Weakness Enumeration

CWE-400

CWE-306

Related Identifiers

CVE-2026-25791

GHSA-WXRW-GVG8-FQJP

GO-2026-4466

SUSE-SU-2026:0757-1

Affected Products

Sliver

References · 120

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25791.json · Exploit
• https://github.com/BishopFox/sliver/security/advisories/GHSA-wxrw-gvg8-fqjp · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4466 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wxrw-gvg8-fqjp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25791 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25791 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:0757-1 · Vendor Advisory
• https://github.com/BishopFox/sliver · Note
• https://github.com/BishopFox/sliver/releases/tag/v1.7.0 · Note
• https://github.com/BishopFox/sliver/commit/2b65089b27c553e79e69f1067cad1339e4f3d937 · Note
• https://suse.com/security/cve/CVE-2026-27611 · Note
• https://suse.com/security/cve/CVE-2025-50180 · Note
• https://suse.com/security/cve/CVE-2026-25791 · Note
• https://suse.com/security/cve/CVE-2026-24051 · Note
• https://suse.com/security/cve/CVE-2026-26314 · Note