NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐹
🐹 Go
Not in CISA KEV
HIGH severity

Sliver has DNS C2 OTP Bypass that Allows Unauthenticated Session Flooding and Denial of ServiceGHSA-wxrw-gvg8-fqjp

HIGHFix: BishopFox/sliver@2b65089

GHSA-wxrw-gvg8-fqjp is a high-severity (CVSS 7.5) Missing Authentication vulnerability in github.com/bishopfox/sliver. A fix is available for github.com/bishopfox/sliver — see the affected versions and patch details below.

Also known asCVE-2026-25791GO-2026-4466
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Nov 10, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for GHSA-wxrw-gvg8-fqjp.

EPSS Exploitation Probability

via FIRST.org ↗
0.4%probability of exploitation in next 30 days
Lower Risk-0.06%
Lower risk than most CVEs39th percentile — riskier than 39% of all scored CVEsHighest risk
0.00%0.34%0.67%1.01%0.0%0.4%Jun 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

1 pkg affected
🐹github.com/bishopfox/sliver

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

Summary

The DNS C2 listener accepts unauthenticated TOTP bootstrap messages and allocates server-side DNS sessions without validating OTP values, even when EnforceOTP is enabled. Because sessions are stored without a cleanup/expiry path in this flow, an unauthenticated remote actor can repeatedly create sessions and drive memory exhaustion.

Vulnerable Component

  • server/c2/dns.go:84-90 (EnforceOTP stored but not enforced in bootstrap)
  • server/c2/dns.go:378-390 (TOTP requests routed directly to bootstrap)
  • server/c2/dns.go:490-521 (handleHello allocates session without OTP validation)
  • server/c2/dns.go:495 (sessions.Store with no lifecycle control in this path)
  • client/command/jobs/dns.go:46-52 (operator-facing EnforceOTP control implies auth gate)
  • implant/sliver/transports/dnsclient/dnsclient.go:896-900 (otpMsg sends TOTP with ID=0)
  • protobuf/dnspb/dns.proto:22 (documents TOTP in ID field)

Attack Vector

  • Network-accessible DNS listener
  • No authentication required
  • Low-complexity repeated DNS query loop
  • Trigger path: DNSMessageType_TOTP bootstrap handling

Proof of Concept

Preconditions

  • DNS listener is reachable
  • DNS C2 job is active

Reproduction Steps

  1. Send repeated DNS queries with a minimal protobuf message of type TOTP.
  2. Observe repeated session allocation/issuance behavior.
  3. Continue requests to increase active in-memory session state.

Example

while true; do
  dig +short @<DNS_C2_IP> baa8.<parent-domain> A >/dev/null
done

baa8 is a base32 payload for a minimal TOTP-type protobuf message.

Observable Indicators

  • Repeated bootstrap/session-allocation log entries from handleHello
  • Rising memory usage in the Sliver server process
  • Service slowdown or instability under sustained request volume

Impact

  • Unauthenticated remote denial of service (availability)
  • Resource exhaustion through unbounded session growth in DNS bootstrap path
  • Estimated CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5 High)

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐹Gogithub.com/bishopfox/sliverall versions1.6.12go get github.com/bishopfox/sliver@v1.6.12

Affected Products

1 product · 1 configurations
Application
sliverbishopfox
< 1.7.0
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/bishopfox/sliver, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update github.com/bishopfox/sliver to 1.6.12 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-wxrw-gvg8-fqjp is resolved across your whole dependency graph.

  3. Workarounds

    Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.

Frequently Asked Questions

## Summary The DNS C2 listener accepts unauthenticated `TOTP` bootstrap messages and allocates server-side DNS sessions without validating OTP values, even when `EnforceOTP` is enabled. Because sessions are stored without a cleanup/expiry path in this flow, an unauthenticated remote actor can repeatedly create sessions and drive memory exhaustion. ## Vulnerable Component - `server/c2/dns.go:84-90` (`EnforceOTP` stored but not enforced in bootstrap) - `server/c2/dns.go:378-390` (`TOTP` requests routed directly to bootstrap) - `server/c2/dns.go:490-521` (`handleHello` allocates session without
O3 Security · Impact-Aware SCA

Is GHSA-wxrw-gvg8-fqjp in your dependencies?

Find it across Go, including transitive dependencies.

Scan my dependencies How O3 SCA works
Sliver has DNS C2 OTP Bypass that Allows…