{"id":"EUVD-2026-117798","enisaUuid":"99662d31-cb1f-3da4-a210-3b472c911ce2","description":"Sliver is a command and control framework. Prior to 1.7.6, an HTTP(S) listener using the PNG encoder accepts attacker-controlled PNG dimensions without an effective decoded-size or pixel limit in util/encoders/images.go, while the listener nonce space implemented in server/encoders/encoders.go is small enough to search remotely. An unauthenticated attacker who identifies a valid nonce can submit a highly compressed image to PNGEncoder.Decode, where it expands during png.Decode, exhausting server memory and causing a complete loss of availability. This vulnerability is fixed in 1.7.6.","datePublished":"Nov 5, 2026, 8:52:39 PM","dateUpdated":"Nov 5, 2026, 8:52:39 PM","baseScore":8.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/BishopFox/sliver/security/advisories/GHSA-663m-7x7m-g4fw\nhttps://github.com/BishopFox/sliver/commit/80273462bd8b2a3cd724d2d6d0301a0cabfa977d\nhttps://github.com/BishopFox/sliver/releases/tag/v1.7.6\n","aliases":"CVE-2026-77622\nGHSA-663m-7x7m-g4fw\n","assigner":"GitHub_M","epss":0.54,"enisaIdProduct":[{"id":"18cdabcf-3cb1-3919-9bde-a1b6d51c3258","product":{"name":"sliver","vendor":{"name":"BishopFox"}},"product_version":"\u003c 1.7.6"}],"enisaIdVendor":[{"id":"2fd275d7-6c69-3c42-95ae-fdd9ec6b97e7","vendor":{"name":"BishopFox"}}],"enisaIdVulnerability":[{"id":"a66d9e92-c249-3bb1-8f1f-560f0052545e","vulnerability":{"id":"CVE-2026-77622","description":"Sliver is a command and control framework. Prior to 1.7.6, an HTTP(S) listener using the PNG encoder accepts attacker-controlled PNG dimensions without an effective decoded-size or pixel limit in util/encoders/images.go, while the listener nonce space implemented in server/encoders/encoders.go is small enough to search remotely. An unauthenticated attacker who identifies a valid nonce can submit a highly compressed image to PNGEncoder.Decode, where it expands during png.Decode, exhausting server memory and causing a complete loss of availability. This vulnerability is fixed in 1.7.6.","datePublished":"Nov 5, 2026, 8:52:39 PM","dateUpdated":"Nov 5, 2026, 8:52:39 PM","status":"PUBLISHED","baseScore":8.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/BishopFox/sliver/security/advisories/GHSA-663m-7x7m-g4fw\nhttps://github.com/BishopFox/sliver/commit/80273462bd8b2a3cd724d2d6d0301a0cabfa977d\nhttps://github.com/BishopFox/sliver/releases/tag/v1.7.6\n","enisa_id":"EUVD-2026-117798\n","assigner":"GitHub_M","epss":0.54,"dataProcessed":"Nov 7, 2026, 4:00:46 PM","vulnerabilityProduct":[{"id":"4b0df652-71bd-334c-b973-3cbd2e6f65f9","product":{"name":"sliver","vendor":{"name":"BishopFox"}},"product_version":"\u003c 1.7.6"}],"vulnerabilityVendor":[{"id":"719e50e3-a6fd-3ef8-8f5b-fe153abb2d72","vendor":{"name":"BishopFox"}}]}},{"id":"de7c5aaa-f2a7-37b7-83d0-d1013cff46bd","vulnerability":{"id":"GHSA-663m-7x7m-g4fw","description":"Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder","datePublished":"Oct 15, 2026, 8:09:33 PM","dateUpdated":"Oct 15, 2026, 8:09:33 PM","baseScore":0.0,"references":"https://github.com/BishopFox/sliver/security/advisories/GHSA-663m-7x7m-g4fw\nhttps://github.com/BishopFox/sliver/commit/80273462bd8b2a3cd724d2d6d0301a0cabfa977d\nhttps://github.com/BishopFox/sliver\nhttps://github.com/BishopFox/sliver/releases/tag/v1.7.6\n","enisa_id":"EUVD-2026-117798\n","aliases":"CVE-2026-77622\nGHSA-663m-7x7m-g4fw\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:48 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}