HIGH GitHub
CVE-2026-77622
Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder
### Summary
Sliver is vulnerable to a Denial of Service (DOS) attack because there is no cap in the size of a PNG file that can be sent to an open http listener and there is a small amount of possible nonces. This vulnerability lets the attacker completely max out the RAM of the machine running server, leading to a complete loss of availability.
### Details
The first vulnerability is that the amount of possible nonces is 65,537. This is found in `server/encoders/encoders.go`
```go
const (
Affected Products
- go/github.com/BishopFox/sliver < 1.7.6
References
- https://github.com/advisories/GHSA-663m-7x7m-g4fw
- https://github.com/BishopFox/sliver/security/advisories/GHSA-663m-7x7m-g4fw
- https://github.com/BishopFox/sliver/commit/80273462bd8b2a3cd724d2d6d0301a0cabfa977d
- https://github.com/BishopFox/sliver/releases/tag/v1.7.6
This high severity vulnerability was published on 2026-10-15 via GitHub. Affected: go/github.com/BishopFox/sliver < 1.7.6.
vulnfeed aggregates 14677 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.