Vulnerability in github.com/BishopFox/sliver (CVE-2026-77622)
Summary
Vulnerability in github.com/BishopFox/sliver (CVE-2026-77622). Risk of unauthorized operations or information disclosure. Exploitable via go.mod. Mitigation: upgrade to 1.7.6 or later.
Original description
The description as published by the source.
Summary
Sliver is vulnerable to a Denial of Service (DOS) attack because there is no cap in the size of a PNG file that can be sent to an open http listener and there is a small amount of possible nonces. This vulnerability lets the attacker completely max out the RAM of the machine running server, leading to a complete loss of availability.
Details
The first vulnerability is that the amount of possible nonces is 65,537. This is found in server/encoders/encoders.go
const (
EncoderModulus = uint64(65537)
)
The second vulnerability is there is no limit to how many pixels the PNG encoder will accept from an unauthenticated user. This is found in:
util/encoders/images.go
func (p PNGEncoder) Encode(data []byte) ([]byte, error) {
img := imageFromBytes(data)
var buf bytes.Buffer
encoder.Encode(&buf, img)
return buf.Bytes(), nil
}
func (p PNGEncoder) Decode(data []byte) ([]byte, error) {
buf := bytes.NewBuffer(data)
img, err := png.Decode(buf)
if err != nil { return nil, err }
return bytesFromImage(img), nil
}
PoC
The first step to reproduce this vulnerability is building a docker container to make sure no harm is caused.
Get the latest version of Sliver (Currently 1.7.3)
git clone https://github.com/BishopFox/sliver.git
Build the Docker container:
cd sliver
docker build -t sliver-test:local -f Dockerfile .
Run the Docker container with a memory cap for example 4GB:
docker…
Source: GitHub Security Advisories (Global) NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-77622 has been found in github.com/BishopFox/sliver.
Attackers can target a specific entry point like go.mod over the network to misuse the product.
Risk of unauthorized operations or information disclosure.
What to do: upgrade github.com/BishopFox/sliver to 1.7.6 or later.
If unsure, ask your IT team or search "github.com/BishopFox/sliver CVE-2026-77622" on the vendor's site.
CVE-2026-77622 (github.com/BishopFox/sliver) — CWE-770
Attack surface: go.mod / poc.go
Patched: 1.7.6 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-770) exists in github.com/BishopFox/sliver. Attackers reach the vulnerable code path via go.mod.
Check the vendor advisory for the affected versions of github.com/BishopFox/sliver. Attack surface: go.mod / poc.go.
Severity: ?. Risk of unauthorized operations or information disclosure.
Update to 1.7.6.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'github.com/BishopFox/sliver' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'github.com/BishopFox/sliver' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
github.com/BishopFox/sliverを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply patch patch
Upgrade github.com/BishopFox/sliver to 1.7.6ステージング環境で 1.7.6 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- package github.com
- web github.com
- web github.com
- web github.com
- web github.com