GHSA-2phg-qgmm-r638
Sliver has Potential Zip Bomb Denial of Service in GzipEncoder
GHSA-2phg-qgmm-r638 is a high vulnerability (CVSS 7.7) in github.com/BishopFox/sliver, published February 25, 2026. No source lists public exploit code. Fixed in github.com/BishopFox/sliver 1.7.2.
- Severity
- 7.7 HighCVSS 4.0, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.7.2github.com/BishopFox/sliver +1 more
Description
Summary
GzipEncoder does not limit output size when processing compressed data. This allows unauthenticated remote attackers to crash sliver server by sending a http request with highly compressed gzip data (aka zip bomb).
Details
In util/encoders/gzip.go, Decode() method decompresses given data by reading the entire gzip buffer at once without limiting output size.
PoC
data = gzip.compress(bytes(1024 * 1024 * 1024)) * 16
requests.post(f"http://172.17.0.2/{nonce}", data=data)
Impact
Unauthenticated remote attackers can exhaust memory and cpu resource of sliver server and crash it when they have GzipEncoderID, which can be easily retrived from implant's http traffic, or by brute-forcing.
A fixed version is available at https://github.com/BishopFox/sliver/releases/tag/v1.7.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/BishopFox/sliverGo | before 1.7.2 | 1.7.2 |
github.com/bishopfox/sliverGo | before 1.7.2 | 1.7.2 |
What each source reports
GitHub Advisories Score used
Sliver has Potential Zip Bomb Denial of Service in GzipEncoder
Summary
GzipEncoder does not limit output size when processing compressed data. This allows unauthenticated remote attackers to crash sliver server by sending a http request with highly compressed gzip data (aka zip bomb).
Details
In util/encoders/gzip.go, Decode() method decompresses given data by reading the entire gzip buffer at once without limiting output size.
PoC
data = gzip.compress(bytes(1024 * 1024 * 1024)) * 16
requests.post(f"http://172.17.0.2/{nonce}", data=data)
Impact
Unauthenticated remote attackers can exhaust memory and cpu resource of sliver server and crash it when they have GzipEncoderID, which can be easily retrived from implant's http traffic, or by brute-forcing.
A fixed version is available at https://github.com/BishopFox/sliver/releases/tag/v1.7.2.
- Record
GHSA-2phg-qgmm-r638- CVSS 4.0
- 7.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P - Weakness
- CWE-409
- Updated
- 2026-11-02
OSV
Sliver has Potential Zip Bomb Denial of Service in GzipEncoder
Summary
GzipEncoder does not limit output size when processing compressed data. This allows unauthenticated remote attackers to crash sliver server by sending a http request with highly compressed gzip data (aka zip bomb).
Details
In util/encoders/gzip.go, Decode() method decompresses given data by reading the entire gzip buffer at once without limiting output size.
PoC
data = gzip.compress(bytes(1024 * 1024 * 1024)) * 16
requests.post(f"http://172.17.0.2/{nonce}", data=data)
Impact
Unauthenticated remote attackers can exhaust memory and cpu resource of sliver server and crash it when they have GzipEncoderID, which can be easily retrived from implant's http traffic, or by brute-forcing.
A fixed version is available at https://github.com/BishopFox/sliver/releases/tag/v1.7.2.
- Record
GHSA-2phg-qgmm-r638- CVSS 4.0
- 7.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P - Weakness
- CWE-409
- Updated
- 2026-11-02
OSVGO-2026-4548No score
Sliver has Potential Zip Bomb Denial of Service in GzipEncoder in github.com/bishopfox/sliver
Sliver has Potential Zip Bomb Denial of Service in GzipEncoder in github.com/bishopfox/sliver
- Record
GO-2026-4548- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.