{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/actors/bishopfox/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["BishopFox"],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Sliver"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","vulnerability","c2-infrastructure"],"_cs_type":"threat","_cs_vendors":["BishopFox"],"content_html":"\u003cp\u003eSliver contains an unauthenticated denial-of-service (DoS) vulnerability within its HTTP(S) listener. The issue stems from the server-side PNG decoder, which lacks validation or constraints on the dimensions and resulting pixel data of incoming image files. By submitting a specially crafted, maliciously large PNG file to the listener, an attacker can trigger excessive memory allocation during the \u003ccode\u003eimage.Decode\u003c/code\u003e and \u003ccode\u003epng.Decode\u003c/code\u003e processes. This process results in rapid RAM consumption, ultimately leading to process termination or complete service exhaustion. The vulnerability is further complicated by the use of predictable nonces in the Sliver protocol, which simplifies the identification of active listener endpoints. This vulnerability poses a significant risk to the availability of C2 infrastructure if exposed to untrusted network segments.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies an exposed Sliver HTTP(S) listener port (e.g., 8080).\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious PNG file with extreme width and height dimensions (e.g., 32,767x32,767 pixels).\u003c/li\u003e\n\u003cli\u003eAttacker uses a tool to systematically probe the listener for nonce requirements or direct delivery if the protocol allows.\u003c/li\u003e\n\u003cli\u003eAttacker sends an HTTP POST request containing the crafted PNG file payload to the Sliver listener.\u003c/li\u003e\n\u003cli\u003eThe Sliver server's HTTP(S) listener receives the binary data.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eserver/encoders/encoders.go\u003c/code\u003e and \u003ccode\u003eutil/encoders/images.go\u003c/code\u003e logic initiates a \u003ccode\u003epng.Decode\u003c/code\u003e operation on the malicious payload.\u003c/li\u003e\n\u003cli\u003eThe server attempts to allocate the buffer required for the uncompressed image, consuming all available system memory.\u003c/li\u003e\n\u003cli\u003eThe Sliver server crashes or stops responding, resulting in a successful DoS.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in a complete denial-of-service of the Sliver C2 server. This prevents operators from maintaining command and control of implants, effectively severing communications with all connected agents. Because the exploit is unauthenticated, any internet-facing Sliver listener is potentially subject to this memory exhaustion attack, risking both operational disruption and potential forensic exposure during the crash state.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the Sliver server to the latest patched version immediately to ensure that input validation is applied to image decoding routines.\u003c/li\u003e\n\u003cli\u003eRestrict access to Sliver HTTP(S) listeners to trusted source IPs via firewall or network access control lists (ACLs).\u003c/li\u003e\n\u003cli\u003eMonitor HTTP traffic targeting Sliver listeners for anomalous POST requests containing binary payloads that deviate from expected C2 heartbeat patterns.\u003c/li\u003e\n\u003cli\u003eImplement memory limits on the container or host environment running the Sliver server to mitigate the impact of OOM (Out-of-Memory) conditions.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-15T22:27:33Z","date_published":"2026-10-15T22:27:33Z","id":"https://feed.craftedsignal.io/briefs/2026-10-sliver-dos/","summary":"Sliver is vulnerable to a denial-of-service attack due to a lack of size constraints during PNG image decoding in its HTTP(S) listener, allowing unauthenticated attackers to exhaust server memory.","title":"Sliver Unauthenticated Memory Exhaustion DoS in PNG Decoder","url":"https://feed.craftedsignal.io/briefs/2026-10-sliver-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - BishopFox","version":"https://jsonfeed.org/version/1.1"}