7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25791

CVE-2026-25791: Sliver has a DNS C2 OTP Bypass Allows Unauthenticated Session Flooding and Denial of Service

Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to 1.7.0, the DNS C2 listener accepts unauthenticated TOTP bootstrap messages and allocates server-side DNS sessions without validating OTP values, even when EnforceOTP is enabled. Because sessions are stored without a cleanup/expiry path in this flow, an unauthenticated remote actor can repeatedly create sessions and drive memory exhaustion. This vulnerability is fixed in 1.7.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25791

CVE-2026-25791:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/bishopfox/sliver	go	<= 1.6.11	1.6.12

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the DNS C2 listener's handling of TOTP bootstrap messages. The core of the issue is in the server/c2/dns.go file, where the handleHello function would create a new DNS session for any incoming TOTP message without performing any authentication. This is explicitly shown by the complete removal of the handleHello function in the patch. The handleC2 function was responsible for routing these TOTP messages to the vulnerable handleHello function.

Furthermore, the accumulateInitData function was also vulnerable to resource exhaustion. It lacked checks to limit the number of pending message reassemblies, allowing an attacker to flood the server with partial messages and consume all available memory. The patch addresses this by adding a hard cap on pending initializations and a garbage collection mechanism.

The exploitation of this vulnerability would involve an attacker sending a continuous stream of specially crafted DNS queries of type TOTP. In a runtime profile, this would result in frequent calls to c2.handleC2 and, in the vulnerable version, to c2.handleHello, leading to a rapid increase in the number of DNSSession objects and memory usage. The c2.accumulateInitData function would also be heavily utilized if the attacker sends fragmented messages.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.