CVE-2026-25791
📋 TL;DR
This vulnerability in Sliver C2 framework allows unauthenticated attackers to create unlimited DNS sessions without OTP validation, leading to memory exhaustion and denial of service. It affects Sliver installations using DNS C2 listeners with EnforceOTP enabled. Attackers can exploit this remotely without authentication.
💻 Affected Systems
- Sliver C2 Framework
📦 What is this software?
Sliver by Bishopfox
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption through memory exhaustion, potentially crashing the C2 server and losing all active implants/agents.
Likely Case
Degraded performance and eventual denial of service as memory is consumed by fake sessions, disrupting command and control operations.
If Mitigated
Limited impact if proper network segmentation and monitoring are in place to detect abnormal DNS traffic patterns.
🎯 Exploit Status
Exploitation requires sending specially crafted DNS requests to the vulnerable listener. No authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.7.0
Vendor Advisory: https://github.com/BishopFox/sliver/security/advisories/GHSA-wxrw-gvg8-fqjp
Restart Required: Yes
Instructions:
1. Download Sliver v1.7.0 from GitHub releases. 2. Stop all Sliver services. 3. Replace existing Sliver binaries with v1.7.0. 4. Restart Sliver services.
🔧 Temporary Workarounds
Disable DNS C2 Listener
allTemporarily disable the vulnerable DNS C2 listener until patching is complete.
sliver > listeners rm [DNS_LISTENER_NAME]
Network ACL Restriction
allRestrict DNS traffic to trusted sources only using firewall rules.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate C2 infrastructure
- Deploy memory monitoring and alerting for abnormal consumption patterns
🔍 How to Verify
Check if Vulnerable:
Check Sliver version and verify if DNS C2 listener is running with EnforceOTP enabled.Check Version:
sliver versionVerify Fix Applied:
Verify Sliver version is 1.7.0 or higher using version command.📡 Detection & Monitoring
Log Indicators:
- Abnormal increase in DNS session creation
- Memory exhaustion alerts from Sliver process
Network Indicators:
- High volume of DNS requests to C2 listener from single/untrusted sources
- DNS requests with TOTP bootstrap patterns
SIEM Query:
source="sliver" AND (event="session_created" OR event="memory_warning") | stats count by src_ip