CVE-2026-25791

The record

Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to 1.7.0, the DNS C2 listener accepts unauthenticated TOTP bootstrap messages and allocates server-side DNS sessions without validating OTP values, even when EnforceOTP is enabled. Because sessions are stored without a cleanup/expiry path in this flow, an unauthenticated remote actor can repeatedly create sessions and drive memory exhaustion. This vulnerability is fixed in 1.7.0.

Affected packages

Related vulnerabilities

• GO-2026-4466 Sliver has DNS C2 OTP Bypass that Allows Unauthenticated Session Flooding and Denial of… Same vulnerability
• GO-2026-4548 Sliver has Potential Zip Bomb Denial of Service in GzipEncoder in… Also affects github.com/bishopfox/sliver
• GO-2026-4445 Sliver Vulnerable to Website Path Traversal / Arbitrary File Read (Authenticated) in… Also affects github.com/bishopfox/sliver
• CVE-2026-25760 Sliver is a command and control framework that uses a custom Wireguard netstack. Also affects github.com/bishopfox/sliver
• GO-2026-4280 Sliver Vulnerable to Pre-Auth Memory Exhaustion via NoEncoder Bypass in… Also affects github.com/bishopfox/sliver
• GO-2025-4079 Silver has unrestricted traffic between Wireguard clients in github.com/bishopfox/sliver Also affects github.com/bishopfox/sliver
• CVE-2025-27093 Sliver is a command and control framework that uses a custom Wireguard netstack. Also affects github.com/bishopfox/sliver
• CVE-2026-33990 Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using… Also affects govulncheck-vulndb