CVE-2026-77622: high-severity vulnerability in BishopFox sliver
Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
41Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 8.2epss 0.5%
from disclosure to weaponsame day
Published on NVDNov 5
1st PoCAug 9
Sliver is a command and control framework. Prior to 1.7.6, an HTTP(S) listener using the PNG encoder accepts attacker-controlled PNG dimensions without an effective decoded-size or pixel limit in util/encoders/images.go, while the listener nonce space implemented in server/encoders/encoders.go is small enough to search remotely. An unauthenticated attacker who identifies a valid nonce can submit a highly compressed image to PNGEncoder.Decode, where it expands during png.Decode, exhausting server memory and causing a complete loss of availability. This vulnerability is fixed in 1.7.6.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
BishopFox · sliverpublic PoCs found — 1
githubgithub.com/Squ1shification/PNGboomer-CVE-2026-77622★ 1⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — BishopFox sliver
In the same product, most dangerous first.
CVE-2024-41111HIGHBishopFox Sliver Authenticated Remote Code ExecutionEPSS 0.7%CVE-2025-27090MEDIUMServer-Side Request Forgery (SSRF) in sliver teamserverEPSS 0.6%CVE-2026-29781LOWSliver: Authenticated Nil-Pointer Dereference in HandlersEPSS 0.6%CVE-2026-25760MEDIUMWebsite Path Traversal / Arbitrary File Read (Authenticated) in SliverEPSS 0.5%CVE-2026-25791HIGHSliver has a DNS C2 OTP Bypass Allows Unauthenticated Session Flooding and Denial of ServiceEPSS 0.4%CVE-2026-34227MEDIUMSliver One-Click Remote Access: Insecure CORS & Unauthenticated MCP InterfaceEPSS 0.4%