https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 23:28:11 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-267776 EUVD-2026-267776 https://cve.radiocsirt.org/vuln/euvd-2026-267776 https://cve.radiocsirt.org/vuln/fkie_cve-2026-25791 <p>Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to 1.7.0, the DNS C2 listener accepts unauthenticated TOTP bootstrap messages and allocates server-side DNS sessions without validating OTP values, even when EnforceOTP is enabled. Because sessions are stored without a cleanup/expiry path in this flow, an unauthenticated remote actor can repeatedly create sessions and drive memory exhaustion. This vulnerability is fixed in 1.7.0.</p> <p>Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to 1.7.0, the DNS C2 listener accepts unauthenticated TOTP bootstrap messages and allocates server-side DNS sessions without validating OTP values, even when EnforceOTP is enabled. Because sessions are stored without a cleanup/expiry path in this flow, an unauthenticated remote actor can repeatedly create sessions and drive memory exhaustion. This vulnerability is fixed in 1.7.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-25791 https://cve.radiocsirt.org/vuln/ghsa-wxrw-gvg8-fqjp <p><strong>Affected:</strong> Go: github.com/bishopfox/sliver</p> <p>## Summary The DNS C2 listener accepts unauthenticated `TOTP` bootstrap messages and allocates server-side DNS sessions without validating OTP values, even when `EnforceOTP` is enabled. Because sessions are stored without a cleanup/expiry path in this flow, an unauthenticated remote actor can repeatedly create sessions and drive memory exhaustion.</p> <p>## Vulnerable Component - `server/c2/dns.go:84-90` (`EnforceOTP` stored but not enforced in bootstrap) - `server/c2/dns.go:378-390` (`TOTP` requests routed directly to bootstrap) - `server/c2/dns.go:490-521` (`handleHello` allocates session without OTP validation) - `server/c2/dns.go:495` (`sessions.Store` with no lifecycle control in this path) - `client/command/jobs/dns.go:46-52` (operator-facing `EnforceOTP` control implies auth gate) - `implant/sliver/transports/dnsclient/dnsclient.go:896-900` (`otpMsg` sends `TOTP` with `ID=0`) - `protobuf/dnspb/dns.proto:22` (documents TOTP in `ID` field)</p> <p>## Attack Vector - Network-accessible DNS listener - No authentication required - Low-complexity repeated DNS query loop - Trigger path: `DNSMessageType_TOTP` bootstrap handling</p> <p>## Proof of Concept ### Preconditions - DNS listener is reachable - DNS C2 job is active</p> <p>### Reproduction Steps 1. Send repeated DNS queries with a minimal protobuf message of type `TOTP`. 2. Observe repeated session allocation/issuance behavior. 3. Continue requests to increase active in-memory session state.</p> <p>### Example ```bash while true; do dig +short @&lt;DN…</p> <p><strong>Affected:</strong> Go: github.com/bishopfox/sliver</p> <p>## Summary The DNS C2 listener accepts unauthenticated `TOTP` bootstrap messages and allocates server-side DNS sessions without validating OTP values, even when `EnforceOTP` is enabled. Because sessions are stored without a cleanup/expiry path in this flow, an unauthenticated remote actor can repeatedly create sessions and drive memory exhaustion.</p> <p>## Vulnerable Component - `server/c2/dns.go:84-90` (`EnforceOTP` stored but not enforced in bootstrap) - `server/c2/dns.go:378-390` (`TOTP` requests routed directly to bootstrap) - `server/c2/dns.go:490-521` (`handleHello` allocates session without OTP validation) - `server/c2/dns.go:495` (`sessions.Store` with no lifecycle control in this path) - `client/command/jobs/dns.go:46-52` (operator-facing `EnforceOTP` control implies auth gate) - `implant/sliver/transports/dnsclient/dnsclient.go:896-900` (`otpMsg` sends `TOTP` with `ID=0`) - `protobuf/dnspb/dns.proto:22` (documents TOTP in `ID` field)</p> <p>## Attack Vector - Network-accessible DNS listener - No authentication required - Low-complexity repeated DNS query loop - Trigger path: `DNSMessageType_TOTP` bootstrap handling</p> <p>## Proof of Concept ### Preconditions - DNS listener is reachable - DNS C2 job is active</p> <p>### Reproduction Steps 1. Send repeated DNS queries with a minimal protobuf message of type `TOTP`. 2. Observe repeated session allocation/issuance behavior. 3. Continue requests to increase active in-memory session state.</p> <p>### Example ```bash while true; do dig +short @&lt;DN…</p> https://cve.radiocsirt.org/vuln/ghsa-wxrw-gvg8-fqjp