CVE-2026-77622: Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder

October 15, 2026

Sliver is vulnerable to a Denial of Service (DOS) attack because there is no cap in the size of a PNG file that can be sent to an open http listener and there is a small amount of possible nonces. This vulnerability lets the attacker completely max out the RAM of the machine running server, leading to a complete loss of availability.

References

github.com/BishopFox/sliver/commit/80273462bd8b2a3cd724d2d6d0301a0cabfa977d
github.com/BishopFox/sliver/releases/tag/v1.7.6
github.com/BishopFox/sliver/security/advisories/GHSA-663m-7x7m-g4fw
github.com/advisories/GHSA-663m-7x7m-g4fw
nvd.nist.gov/vuln/detail/CVE-2026-77622

Code Behaviors & Features

Detect and mitigate CVE-2026-77622 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →