{"id":"GHSA-hjr9-wj7v-7hv8","aliases":["GO-2026-4280"],"status":"published","title":"Sliver Vulnerable to Pre-Auth Memory Exhaustion via NoEncoder Bypass","description":"### Summary\nA specially crafted nonce routes unauthenticated requests through the NoEncoder path, where `startSessionHandler()` reads the entire request body without limits, allowing attacker-driven memory exhaustion and process crash.\n\n### Details\n- `server/encoders/encoders.go`: `EncoderFromNonce()` returns NoEncoder when `nonce % 65537 == 0` (lines 254-264); NoEncoder is a passthrough (`util/encoders/nop.go:22-32`).\n- `server/c2/http.go`: `anonymousHandler()` routes requests with any encoder (including NoEncoder) to `startSessionHandler()` (lines 551-562).\n- `server/c2/http.go`: `startSessionHandler()` uses `io.ReadAll(req.Body)` without a size cap (lines 564-643), unlike the authenticated path that uses `io.LimitedReader` (`readReqBody()`, lines 708-732).\n\n### PoC\nAn attacker could send an HTTP POST with a nonce that is a multiple of 65537 (e.g., ?q=65537) so it is handled by startSessionHandler() with a NoEncoder, and advertise a very large Content-Length while streaming data. Because this handler uses io.ReadAll(req.Body) without a size limit, the server is expected to allocate large amounts of memory and may exhaust available RAM, leading to process termination on typical deployments.\n\n### Impact\nUnauthenticated remote DoS: attacker can crash the Sliver HTTP listener, dropping all active sessions and locking out operators until restart. No credentials or non-default config required.","severity":{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-770"],"published":"2026-01-05T19:43:06Z","modified":"2026-03-03T04:57:50Z","affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/bishopfox/sliver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.0"},{"last_affected":"1.5.44"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/bishopfox/sliver","ranges":[{"type":"SEMVER","events":[{"introduced":"1.5.0"},{"last_affected":"1.5.44"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/bishopfox/sliver","ranges":[{"type":"SEMVER","events":[{"introduced":"1.5.0"}]}]}],"references":[{"url":"https://github.com/BishopFox/sliver/security/advisories/GHSA-hjr9-wj7v-7hv8","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-hjr9-wj7v-7hv8"},{"url":"https://github.com/BishopFox/sliver","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-hjr9-wj7v-7hv8","title":"Sliver Vulnerable to Pre-Auth Memory Exhaustion via NoEncoder Bypass","description":"### Summary\nA specially crafted nonce routes unauthenticated requests through the NoEncoder path, where `startSessionHandler()` reads the entire request body without limits, allowing attacker-driven memory exhaustion and process crash.\n\n### Details\n- `server/encoders/encoders.go`: `EncoderFromNonce()` returns NoEncoder when `nonce % 65537 == 0` (lines 254-264); NoEncoder is a passthrough (`util/encoders/nop.go:22-32`).\n- `server/c2/http.go`: `anonymousHandler()` routes requests with any encoder (including NoEncoder) to `startSessionHandler()` (lines 551-562).\n- `server/c2/http.go`: `startSessionHandler()` uses `io.ReadAll(req.Body)` without a size cap (lines 564-643), unlike the authenticated path that uses `io.LimitedReader` (`readReqBody()`, lines 708-732).\n\n### PoC\nAn attacker could send an HTTP POST with a nonce that is a multiple of 65537 (e.g., ?q=65537) so it is handled by startSessionHandler() with a NoEncoder, and advertise a very large Content-Length while streaming data. Because this handler uses io.ReadAll(req.Body) without a size limit, the server is expected to allocate large amounts of memory and may exhaust available RAM, leading to process termination on typical deployments.\n\n### Impact\nUnauthenticated remote DoS: attacker can crash the Sliver HTTP listener, dropping all active sessions and locking out operators until restart. No credentials or non-default config required.","status":"published","published":"2026-01-05T19:43:06Z","modified":"2026-01-05T19:43:07Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:39:15.106458Z"}],"osv":[{"id":"GHSA-hjr9-wj7v-7hv8","title":"Sliver Vulnerable to Pre-Auth Memory Exhaustion via NoEncoder Bypass","description":"### Summary\nA specially crafted nonce routes unauthenticated requests through the NoEncoder path, where `startSessionHandler()` reads the entire request body without limits, allowing attacker-driven memory exhaustion and process crash.\n\n### Details\n- `server/encoders/encoders.go`: `EncoderFromNonce()` returns NoEncoder when `nonce % 65537 == 0` (lines 254-264); NoEncoder is a passthrough (`util/encoders/nop.go:22-32`).\n- `server/c2/http.go`: `anonymousHandler()` routes requests with any encoder (including NoEncoder) to `startSessionHandler()` (lines 551-562).\n- `server/c2/http.go`: `startSessionHandler()` uses `io.ReadAll(req.Body)` without a size cap (lines 564-643), unlike the authenticated path that uses `io.LimitedReader` (`readReqBody()`, lines 708-732).\n\n### PoC\nAn attacker could send an HTTP POST with a nonce that is a multiple of 65537 (e.g., ?q=65537) so it is handled by startSessionHandler() with a NoEncoder, and advertise a very large Content-Length while streaming data. Because this handler uses io.ReadAll(req.Body) without a size limit, the server is expected to allocate large amounts of memory and may exhaust available RAM, leading to process termination on typical deployments.\n\n### Impact\nUnauthenticated remote DoS: attacker can crash the Sliver HTTP listener, dropping all active sessions and locking out operators until restart. No credentials or non-default config required.","status":"published","published":"2026-01-05T19:43:06Z","modified":"2026-02-03T03:13:59.249624Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:49.28217Z"},{"id":"GO-2026-4280","title":"Sliver Vulnerable to Pre-Auth Memory Exhaustion via NoEncoder Bypass in github.com/bishopfox/sliver","description":"Sliver Vulnerable to Pre-Auth Memory Exhaustion via NoEncoder Bypass in github.com/bishopfox/sliver","status":"published","published":"2026-01-12T17:39:39Z","modified":"2026-03-03T04:57:50.871509Z","updated_at":"2026-11-02T15:47:02.011123Z"}]}}