CVE-2026-25791: Sliver C2 Framework DoS Vulnerability

CVE-2026-25791 Overview

CVE-2026-25791 is a Missing Authentication for Critical Function (CWE-306) vulnerability in the Sliver command and control (C2) framework. Sliver uses a custom Wireguard netstack and is widely used for red team engagements and adversary simulation. Prior to version 1.7.0, the DNS C2 listener accepts unauthenticated TOTP bootstrap messages and allocates server-side DNS sessions without validating OTP values, even when the EnforceOTP configuration option is enabled. Because sessions are stored without a cleanup or expiry path in this flow, an unauthenticated remote actor can repeatedly create sessions and drive memory exhaustion on the server.

Critical Impact

Unauthenticated remote attackers can cause denial of service through uncontrolled memory exhaustion by repeatedly creating DNS sessions without valid OTP authentication.

Affected Products

• Sliver C2 Framework versions prior to 1.7.0
• Systems running Sliver DNS C2 listeners with or without EnforceOTP enabled

Discovery Timeline

• 2026-02-09 - CVE-2026-25791 published to NVD
• 2026-02-09 - Last updated in NVD database

Technical Details for CVE-2026-25791

Vulnerability Analysis

This vulnerability represents a critical authentication bypass in the DNS command and control communication channel of the Sliver framework. The core issue lies in the TOTP (Time-based One-Time Password) bootstrap message handling within the DNS C2 listener component.

When an implant or client initiates a connection to the Sliver server via DNS, it sends a TOTP bootstrap message to establish a session. The vulnerability exists because the server allocates and stores a new DNS session in memory upon receiving these bootstrap messages without first validating the OTP value—even when operators have explicitly enabled the EnforceOTP security control. This means the authentication check that should protect against unauthorized session creation is completely bypassed.

The impact is compounded by the absence of a session cleanup or expiration mechanism in this specific code path. Each unauthenticated request creates a persistent session object that remains in server memory indefinitely, creating a clear path to resource exhaustion.

Root Cause

The root cause is a Missing Authentication for Critical Function (CWE-306) vulnerability in the DNS C2 listener's session allocation logic. The server fails to validate OTP tokens before allocating server-side resources, and lacks garbage collection for sessions created through this unauthenticated path. The EnforceOTP configuration flag is ineffective against this attack vector because the validation occurs after session allocation, not before.

Attack Vector

The attack is network-accessible and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending crafted DNS queries containing TOTP bootstrap messages to a Sliver server's DNS C2 listener. The attack methodology involves:

1. Identifying a target Sliver DNS C2 listener endpoint
2. Crafting and sending repeated TOTP bootstrap DNS queries
3. Each query triggers server-side session allocation without OTP validation
4. Sessions accumulate in memory without expiration
5. Continued requests eventually exhaust server memory, causing denial of service

The vulnerability is particularly concerning because it can be exploited against servers where administrators believe they have protected the endpoint by enabling EnforceOTP. The attack can originate from any network location with DNS access to the C2 listener.

Detection Methods for CVE-2026-25791

Indicators of Compromise

• Unusual spike in DNS queries targeting Sliver C2 listener domains or endpoints
• Rapid memory consumption on systems running Sliver server components
• Large number of DNS session objects without corresponding authenticated implant connections
• Server performance degradation or out-of-memory errors on Sliver infrastructure

Detection Strategies

• Monitor memory utilization trends on Sliver C2 server infrastructure for unusual growth patterns
• Implement DNS query rate limiting and anomaly detection for C2 listener endpoints
• Configure alerts for rapid session creation rates that exceed expected implant deployment patterns
• Deploy network-based detection for high-volume DNS traffic patterns consistent with exhaustion attacks

Monitoring Recommendations

• Enable verbose logging on Sliver DNS C2 listeners to capture bootstrap message activity
• Establish baseline memory usage patterns and alert on deviations exceeding normal operational thresholds
• Monitor DNS query logs for source IPs sending abnormal volumes of bootstrap-style queries
• Integrate Sliver server metrics with SIEM platforms for centralized visibility and correlation

How to Mitigate CVE-2026-25791

Immediate Actions Required

• Upgrade Sliver C2 framework to version 1.7.0 or later immediately
• Audit current Sliver deployments to identify all DNS C2 listener configurations
• Consider temporarily disabling DNS C2 listeners if upgrade cannot be performed immediately
• Implement network-level rate limiting for DNS traffic to C2 infrastructure as an interim control

Patch Information

The vulnerability is fixed in Sliver version 1.7.0. Users should upgrade to this version or later to remediate the vulnerability. The fix ensures proper OTP validation occurs before session allocation and implements appropriate session lifecycle management.

For detailed patch information, refer to the GitHub Sliver Release v1.7.0 and the GitHub Security Advisory GHSA-wxrw-gvg8-fqjp.

Workarounds

• Restrict network access to DNS C2 listeners using firewall rules to allow only expected source IP ranges
• Deploy DNS C2 listeners behind a reverse proxy or load balancer with built-in rate limiting capabilities
• If DNS C2 is not operationally required, disable DNS listeners and use alternative C2 channels (HTTP/HTTPS, mTLS, WireGuard)
• Implement infrastructure monitoring to detect and respond to memory exhaustion conditions before service impact

# Example: Restrict DNS C2 listener access using iptables
# Allow DNS traffic only from expected implant source ranges
iptables -A INPUT -p udp --dport 53 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p udp --dport 53 -j DROP

# Monitor memory usage on Sliver server
watch -n 5 'free -m && ps aux --sort=-%mem | head -10'