CVE-2026-29781: BishopFox Sliver C2 DoS Vulnerability

CVE-2026-29781 Overview

CVE-2026-29781 is a Null Pointer Dereference vulnerability affecting BishopFox Sliver, an open-source command and control (C2) framework that leverages a custom WireGuard netstack for secure implant communications. The vulnerability exists in the Sliver C2 server's Protobuf unmarshalling logic due to a systemic lack of nil-pointer validation. An authenticated attacker with access to valid implant credentials can craft malicious messages that omit nested fields, triggering an unhandled runtime panic that terminates the entire C2 server process.

Critical Impact

This vulnerability acts as an infrastructure "kill-switch" that can instantly sever all active C2 sessions across an entire deployment, requiring manual server restart to restore operations.

Affected Products

• BishopFox Sliver versions from 1.7.3 and prior
• Sliver C2 server deployments using mTLS, WireGuard, or DNS transport layers
• Organizations using Sliver for authorized penetration testing and red team operations

Discovery Timeline

• 2026-03-07 - CVE CVE-2026-29781 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-29781

Vulnerability Analysis

The vulnerability stems from improper input validation in the Protobuf message handling routines within the Sliver C2 server. When processing signed messages from implants, the server deserializes Protobuf structures without adequately checking for nil pointers in nested message fields. This oversight allows an attacker who has obtained valid implant credentials to construct specially crafted messages that exploit the missing validation.

The impact is particularly severe because certain transport layers in Sliver—specifically mTLS, WireGuard, and DNS—lack the panic recovery middleware that exists in the HTTP transport layer. When a nil pointer dereference occurs during message processing on these transports, the resulting runtime panic propagates unhandled and crashes the entire server process.

Root Cause

The root cause is CWE-476: NULL Pointer Dereference. The Sliver server's Protobuf unmarshalling code assumes that nested message fields will always be present and populated. When these fields are omitted from a signed message (which passes cryptographic validation due to having valid implant credentials), subsequent code attempts to access properties of nil objects, triggering a Go runtime panic.

The inconsistent application of panic recovery middleware across different transport layers compounds the issue. While HTTP transport includes proper error handling that can recover from such panics, the mTLS, WireGuard, and DNS transports do not, making them susceptible to complete service termination.

Attack Vector

The attack requires network access and post-authentication privileges—specifically, an attacker must possess captured or compromised implant credentials. With valid credentials, the attacker can authenticate to the C2 server and submit malformed Protobuf messages that pass signature verification but contain omitted nested fields.

When the server processes these messages, it dereferences nil pointers expecting populated nested structures. The resulting unhandled panic terminates the server process globally, affecting all connected implants and operator sessions simultaneously. This represents a significant operational security risk for red team engagements, as a single compromised implant could be leveraged to disrupt an entire operation.

The attack does not require user interaction and can be executed remotely over the network against any of the vulnerable transport protocols.

Detection Methods for CVE-2026-29781

Indicators of Compromise

• Unexpected termination of the Sliver C2 server process with panic-related error messages in logs
• Go runtime panic traces referencing nil pointer dereferences in Protobuf handling code
• Abnormal connection patterns from implants sending malformed or incomplete Protobuf messages
• Sudden loss of all implant connections without network infrastructure changes

Detection Strategies

• Monitor Sliver server logs for panic traces and runtime errors indicating nil pointer access
• Implement process monitoring to detect unexpected C2 server terminations and rapid restart cycles
• Analyze network traffic for anomalous implant communications, particularly messages with unusual structure
• Deploy behavioral analysis to identify implants sending messages that deviate from expected Protobuf schemas

Monitoring Recommendations

• Configure alerting for Sliver server process crashes and automatic restart events
• Implement centralized logging to capture server panic traces before process termination
• Monitor implant credential usage patterns for indicators of compromise or unauthorized access
• Establish baseline communication patterns to detect anomalous implant behavior

How to Mitigate CVE-2026-29781

Immediate Actions Required

• Review and audit implant credential security to prevent unauthorized access to valid credentials
• Implement network segmentation to limit exposure of C2 infrastructure
• Consider temporarily switching to HTTP transport if available, as it includes panic recovery middleware
• Establish manual monitoring procedures to quickly detect and respond to server terminations

Patch Information

At the time of publication, there are no publicly available patches for this vulnerability. Organizations should monitor the BishopFox Sliver GitHub Security Advisory for updates and patch availability. Users are encouraged to subscribe to security notifications from the BishopFox Sliver project to receive timely updates when a fix is released.

Workarounds

• Rotate implant credentials regularly and implement strict access controls for credential storage
• Use HTTP transport where operationally feasible, as it includes panic recovery capabilities
• Deploy the C2 server behind additional access controls and authentication layers
• Implement automated server restart mechanisms to minimize downtime in case of exploitation
• Consider running multiple isolated C2 server instances to prevent single points of failure