Live › vulnerability › CVE-2026-77622
Go to dashboardSliver is a command-and-control framework, and its HTTP(S) listener decodes PNG data without authentication and without sufficient memory limits. An unauthenticated remote attacker can exhaust the server's memory and crash the listener.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/bishopfox/sliver | go | < 1.7.6 | 1.7.6 |
Check the Go module version: run go list -m github.com/bishopfox/sliver in the project, or inspect the sliver server binary version.
Upgrade github.com/bishopfox/sliver to 1.7.6 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder in github.com/bishopfox/sliver
This page as .md · .json · in your agent: get_signal("CVE-2026-77622")
Go Vulnerability Database, CC-BY 4.0. Posts quoted belong to their authors.