CVE-2026-77622 - Sliver Unauthenticated Memory Exhaustion Denial of Service

CVE-2026-77622 - Sliver: Unauthenticated Memory Exhaustion Denial of Service

Published Date: November 5, 2026
Source: Cvefeed

CVE-2026-77622 describes a critical vulnerability in the Sliver command and control framework. Prior to version 1.7.6, the HTTP(S) listener using the PNG encoder accepted attacker-controlled PNG dimensions without effective limits on decoded size or pixel count. This flaw allows an unauthenticated attacker to exploit the system by submitting a highly compressed image to PNGEncoder.Decode, which expands during png.Decode, leading to server memory exhaustion and a complete loss of availability. 🚨

Key Details:

• Vulnerability Type: Unauthenticated Memory Exhaustion Denial of Service
• Affected Component: Sliver HTTP(S) Listener PNG Decoder
• Fix Version: 1.7.6

Recommendations:

To mitigate this vulnerability, it is essential to:

• Remove size limits on incoming PNG files.
• Increase nonce space to prevent denial of service.
• Cap the size of incoming PNG files.
• Limit memory usage for resource-intensive operations.
• Apply security patches or updates from the vendor.

Associated CWEs:

• CWE-770: Allocation of Resources Without Limits or Throttling

Common Attack Patterns:

• CAPEC-125: Flooding
• CAPEC-130: Excessive Allocation
• CAPEC-147: XML Ping of the Death
• CAPEC-197: Exponential Data Expansion
• CAPEC-229: Serialized Data Parameter Blowup
• CAPEC-230: Serialized Data with Nested Payloads
• CAPEC-231: Oversized Serialized Data Payloads
• CAPEC-469: HTTP DoS
• CAPEC-482: TCP Flood
• CAPEC-486: UDP Flood

For more details, you can read the complete article here: Read full article