GHSA-wxrw-gvg8-fqjp

Source

https://github.com/advisories/GHSA-wxrw-gvg8-fqjp

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-wxrw-gvg8-fqjp/GHSA-wxrw-gvg8-fqjp.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-wxrw-gvg8-fqjp

Aliases

Published

2026-02-06T22:52:00Z

Modified

2026-02-19T20:56:50Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Sliver has DNS C2 OTP Bypass that Allows Unauthenticated Session Flooding and Denial of Service

Details

Summary

The DNS C2 listener accepts unauthenticated TOTP bootstrap messages and allocates server-side DNS sessions without validating OTP values, even when EnforceOTP is enabled. Because sessions are stored without a cleanup/expiry path in this flow, an unauthenticated remote actor can repeatedly create sessions and drive memory exhaustion.

Vulnerable Component

server/c2/dns.go:84-90 (EnforceOTP stored but not enforced in bootstrap)
server/c2/dns.go:378-390 (TOTP requests routed directly to bootstrap)
server/c2/dns.go:490-521 (handleHello allocates session without OTP validation)
server/c2/dns.go:495 (sessions.Store with no lifecycle control in this path)
client/command/jobs/dns.go:46-52 (operator-facing EnforceOTP control implies auth gate)
implant/sliver/transports/dnsclient/dnsclient.go:896-900 (otpMsg sends TOTP with ID=0)
protobuf/dnspb/dns.proto:22 (documents TOTP in ID field)

Attack Vector

Network-accessible DNS listener
No authentication required
Low-complexity repeated DNS query loop
Trigger path: DNSMessageType_TOTP bootstrap handling

Proof of Concept

Preconditions

DNS listener is reachable
DNS C2 job is active

Reproduction Steps

Send repeated DNS queries with a minimal protobuf message of type TOTP.
Observe repeated session allocation/issuance behavior.
Continue requests to increase active in-memory session state.

Example

while true; do
  dig +short @<DNS_C2_IP> baa8.<parent-domain> A >/dev/null
done

baa8 is a base32 payload for a minimal TOTP-type protobuf message.

Observable Indicators

Repeated bootstrap/session-allocation log entries from handleHello
Rising memory usage in the Sliver server process
Service slowdown or instability under sustained request volume

Impact

Unauthenticated remote denial of service (availability)
Resource exhaustion through unbounded session growth in DNS bootstrap path
Estimated CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5 High)

Database specific

{
    "cwe_ids":  [
        "CWE-306",
        "CWE-400"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-02-06T22:52:00Z",
    "nvd_published_at":  "2026-02-09T21:15:49Z",
    "severity":  "HIGH"
}

References

Affected packages

Go / github.com/bishopfox/sliver

Package

Name: github.com/bishopfox/sliver; View open source insights on deps.dev
Purl: pkg:golang/github.com/bishopfox/sliver

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.6.12

Database specific

last_known_affected_version_range

"<= 1.6.11"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-wxrw-gvg8-fqjp/GHSA-wxrw-gvg8-fqjp.json"