GHSA-hjr9-wj7v-7hv8
Sliver Vulnerable to Pre-Auth Memory Exhaustion via NoEncoder Bypass
GHSA-hjr9-wj7v-7hv8 is a medium vulnerability (CVSS 5.5) in github.com/bishopfox/sliver, published January 5, 2026. No source lists public exploit code. No source names a fixed version.
- Severity
- 5.5 MediumCVSS 4.0, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
Summary
A specially crafted nonce routes unauthenticated requests through the NoEncoder path, where startSessionHandler() reads the entire request body without limits, allowing attacker-driven memory exhaustion and process crash.
Details
server/encoders/encoders.go:EncoderFromNonce()returns NoEncoder whennonce % 65537 == 0(lines 254-264); NoEncoder is a passthrough (util/encoders/nop.go:22-32).server/c2/http.go:anonymousHandler()routes requests with any encoder (including NoEncoder) tostartSessionHandler()(lines 551-562).server/c2/http.go:startSessionHandler()usesio.ReadAll(req.Body)without a size cap (lines 564-643), unlike the authenticated path that usesio.LimitedReader(readReqBody(), lines 708-732).
PoC
An attacker could send an HTTP POST with a nonce that is a multiple of 65537 (e.g., ?q=65537) so it is handled by startSessionHandler() with a NoEncoder, and advertise a very large Content-Length while streaming data. Because this handler uses io.ReadAll(req.Body) without a size limit, the server is expected to allocate large amounts of memory and may exhaust available RAM, leading to process termination on typical deployments.
Impact
Unauthenticated remote DoS: attacker can crash the Sliver HTTP listener, dropping all active sessions and locking out operators until restart. No credentials or non-default config required.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/bishopfox/sliverGo | 1.5.0 to 1.5.44 | None known |
github.com/bishopfox/sliverGo | 1.5.0 and later | None known |
What each source reports
GitHub Advisories Score used
Sliver Vulnerable to Pre-Auth Memory Exhaustion via NoEncoder Bypass
Summary
A specially crafted nonce routes unauthenticated requests through the NoEncoder path, where startSessionHandler() reads the entire request body without limits, allowing attacker-driven memory exhaustion and process crash.
Details
server/encoders/encoders.go:EncoderFromNonce()returns NoEncoder whennonce % 65537 == 0(lines 254-264); NoEncoder is a passthrough (util/encoders/nop.go:22-32).server/c2/http.go:anonymousHandler()routes requests with any encoder (including NoEncoder) tostartSessionHandler()(lines 551-562).server/c2/http.go:startSessionHandler()usesio.ReadAll(req.Body)without a size cap (lines 564-643), unlike the authenticated path that usesio.LimitedReader(readReqBody(), lines 708-732).
PoC
An attacker could send an HTTP POST with a nonce that is a multiple of 65537 (e.g., ?q=65537) so it is handled by startSessionHandler() with a NoEncoder, and advertise a very large Content-Length while streaming data. Because this handler uses io.ReadAll(req.Body) without a size limit, the server is expected to allocate large amounts of memory and may exhaust available RAM, leading to process termination on typical deployments.
Impact
Unauthenticated remote DoS: attacker can crash the Sliver HTTP listener, dropping all active sessions and locking out operators until restart. No credentials or non-default config required.
- Record
GHSA-hjr9-wj7v-7hv8- CVSS 4.0
- 5.5 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P - Weakness
- CWE-770
- Updated
- 2026-11-02
OSV
Sliver Vulnerable to Pre-Auth Memory Exhaustion via NoEncoder Bypass
Summary
A specially crafted nonce routes unauthenticated requests through the NoEncoder path, where startSessionHandler() reads the entire request body without limits, allowing attacker-driven memory exhaustion and process crash.
Details
server/encoders/encoders.go:EncoderFromNonce()returns NoEncoder whennonce % 65537 == 0(lines 254-264); NoEncoder is a passthrough (util/encoders/nop.go:22-32).server/c2/http.go:anonymousHandler()routes requests with any encoder (including NoEncoder) tostartSessionHandler()(lines 551-562).server/c2/http.go:startSessionHandler()usesio.ReadAll(req.Body)without a size cap (lines 564-643), unlike the authenticated path that usesio.LimitedReader(readReqBody(), lines 708-732).
PoC
An attacker could send an HTTP POST with a nonce that is a multiple of 65537 (e.g., ?q=65537) so it is handled by startSessionHandler() with a NoEncoder, and advertise a very large Content-Length while streaming data. Because this handler uses io.ReadAll(req.Body) without a size limit, the server is expected to allocate large amounts of memory and may exhaust available RAM, leading to process termination on typical deployments.
Impact
Unauthenticated remote DoS: attacker can crash the Sliver HTTP listener, dropping all active sessions and locking out operators until restart. No credentials or non-default config required.
- Record
GHSA-hjr9-wj7v-7hv8- CVSS 4.0
- 5.5 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVGO-2026-4280No score
Sliver Vulnerable to Pre-Auth Memory Exhaustion via NoEncoder Bypass in github.com/bishopfox/sliver
Sliver Vulnerable to Pre-Auth Memory Exhaustion via NoEncoder Bypass in github.com/bishopfox/sliver
- Record
GO-2026-4280- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.