Denial of Service Vulnerability in Sliver Command and Control Framework

CVE-2026-77622

What is CVE-2026-77622?

The Sliver command and control framework has a vulnerability in its HTTP(S) listener that allows an unauthenticated attacker to exploit the system by submitting a specially crafted PNG image. Prior to version 1.7.6, the PNG encoder accepted attacker-controlled dimensions without enforcing size limitations. This oversight enables the attacker to exhaust server resources through a highly compressed image, leading to a complete denial of service. The vulnerability has been addressed in version 1.7.6, which includes necessary security enhancements to mitigate this risk.

References