CVE-2026-25791 Sliver has a DNS C2 OTP Bypass Allows Unauthenticated Session Flooding and Denial of Service
Unauthenticated attackers can flood Sliver C2 server with DNS sessions, causing memory exhaustion and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-25791?
CVE-2026-25791 is a high-severity denial of service vulnerability in BishopFox sliver, published on 9 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to 1.7.0, the DNS C2 listener accepts unauthenticated TOTP bootstrap messages and allocates server-side DNS sessions without validating OTP values, even when EnforceOTP is enabled. Because sessions are stored without a cleanup/expiry path in this flow, an unauthenticated remote actor can repeatedly create sessions and drive memory exhaustion. This vulnerability is fixed in 1.7.0.
Which versions are affected by CVE-2026-25791?
3 open source packages ship an affected version, including github.com/bishopfox/sliver. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/bishopfox/sliver Go | All versions | None |
github.com/bishopfox/sliver Go | All versions | 1.6.12 |
github.com/bishopfox/sliver Go | All versions | 1.6.12 |
Products include Bishopfox Sliver.
How do I fix CVE-2026-25791?
Upgrade github.com/bishopfox/sliver to 1.6.12 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-25791 being exploited?
There is no known exploitation of CVE-2026-25791 in the wild and no public exploit code.
Other vulnerabilities in BishopFox sliver
- CVE-2023-34758 Silver vulnerable to MitM attack against implants due to a cryptography vulnerability
- CVE-2025-27090 Server-Side Request Forgery (SSRF) in sliver teamserver
- CVE-2026-25760 Website Path Traversal / Arbitrary File Read (Authenticated) in Sliver
- CVE-2026-34227 Sliver One-Click Remote Access: Insecure CORS & Unauthenticated MCP Interface
- CVE-2026-32941 Sliver Vulnerable to Authenticated OOM via Memory Exhaustion in mTLS/WireGuard Transports
Sources
Also known as GHSA-wxrw-gvg8-fqjp, GO-2026-4466.