{"id":"CVE-2026-77622","kind":"vulnerability","aliases":["CVE-2026-77622","GHSA-663m-7x7m-g4fw","GO-2026-6777"],"related":[],"title":"Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder in github.com/bishopfox/sliver","description":"Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder in github.com/bishopfox/sliver","summary":"Sliver is a command-and-control framework, and its HTTP(S) listener decodes PNG data without authentication and without sufficient memory limits. An unauthenticated remote attacker can exhaust the server's memory and crash the listener.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/bishopfox/sliver","fixed":["1.7.6"],"affected":"< 1.7.6","ecosystem":"go"}],"ecosystems":["go"],"tags":["c2","go","package","red-team","sliver"],"not_affected_if":["version-1.7.6-or-later"],"how_to_check":"Check the Go module version: run 'go list -m github.com/bishopfox/sliver' in the project, or inspect the sliver server binary version.","fix":"Upgrade github.com/bishopfox/sliver to 1.7.6 or later.","status":"open","published_at":"2026-10-19T21:08:35+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T20:15:22+00:00","updated_at":"2026-10-23T20:15:22+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T20:15:22Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/bishopfox/sliver to 1.7.6 or later.\nunknown","summary":"Sliver is a command-and-control framework, and its HTTP(S) listener decodes PNG data without authentication and without sufficient memory limits. An unauthenticated remote attacker can exhaust the server's memory and crash the listener.","category":"package","who_cares":["go","sliver","red-team","c2"],"confidence":0.7,"analyst_note":"Sources give no CVSS score or exploitation details; check https://pkg.go.dev/vuln/GO-2026-6777 and GHSA-663m-7x7m-g4fw for the affected listener conditions and the fix commit.","how_to_check":"Check the Go module version: run 'go list -m github.com/bishopfox/sliver' in the project, or inspect the sliver server binary version.\nunknown","needs_analyst":true,"not_affected_if":["version-1.7.6-or-later"],"severity_if_unknown":"unknown"},"cost_usd":0.000379,"input_tokens":2054,"output_tokens":348,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':20A,28A,31A '-6777':29A '-77622':21A,32A '/bishopfox/sliver':18A,35A,97C '663m':24A '7x7m':25A 'attack':69B 'authent':60B 'c2':36B 'command':47B 'command-and-control':46B 'control':49B 'crash':77B 'cve':19A,30A 'data':58B 'decod':14A,56B,93C 'denial':5A,84C 'exhaust':4A,71B,83C 'framework':50B 'g4fw':26A 'ghsa':23A 'ghsa-663m-7x7m-g4fw':22A 'github.com':17A,34A,96C 'github.com/bishopfox/sliver':16A,33A,95C 'go':27A,37B 'http':10A,53B,89C 'limit':65B 'listen':12A,55B,79B,91C 'memori':3A,64B,75B,82C 'packag':38B 'png':13A,57B,92C 'red':40B 'red-team':39B 'remot':68B 'server':73B 'servic':7A,86C 'sliver':1A,9A,42B,43B,80C,88C 'suffici':63B 'team':41B 'unauthent':2A,67B,81C 'without':59B,62B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T21:08:35+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6777","url":"https://pkg.go.dev/vuln/GO-2026-6777","severity":null,"published_at":"2026-10-19T21:08:35+00:00","modified_at":"2026-10-19T21:08:35+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}