CVE-2026-25791: bishopfox sliver

Vulnerability summary

CVE-2026-25791 is a high (CVSS 7.5) vulnerability in bishopfox sliver. EPSS estimates a 0.55% chance of exploitation in the next 30 days, higher than 45.1% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 09-02-2026
   PublishedVulnerability first disclosed.
2. 10-02-2026
   Last modifiedVulnerability information updated.

Description

Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to 1.7.0, the DNS C2 listener accepts unauthenticated TOTP bootstrap messages and allocates server-side DNS sessions without validating OTP values, even when EnforceOTP is enabled. Because sessions are stored without a cleanup/expiry path in this flow, an unauthenticated remote actor can repeatedly create sessions and drive memory exhaustion. This vulnerability is fixed in 1.7.0.

• CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
• CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.