CVE-2026-77622 with a CVSS score of 8.2 is a denial-of-service vulnerability in the Sliver HTTP(S) listener PNG decoder, affecting Sliver versions below 1.7.6. The flaw is an uncontrolled resource consumption issue, classified as CWE-770, in the component that decodes PNG payloads received by an open HTTP listener. The decoder accepts PNG data from unauthenticated users without limiting image size or pixel count, and the encoder nonce space is limited to 65,537 possible values. An attacker can exploit this over the network by sending crafted PNG requests to the listener, using the small nonce space to identify or target the expected nonce and then causing the server to decode an excessively large image. The attack requires no authentication or user interaction, but has high complexity because the attacker must account for nonce selection and timing. Successful exploitation can exhaust the memory of the machine running the server, causing a complete loss of availability. For organizations relying on Sliver for command-and-control or operational tooling, this can disrupt incident response, monitoring, or security operations, degrade dependent services, and create operational risk if the listener is reachable from untrusted networks.
We recommend you to update Sliver to version 1.7.6.[/subscribe_to_unlock_form]
CVE-2026-77622 with a CVSS score of 8.2 is a denial-of-service vulnerability in the Sliver HTTP(S) listener PNG decoder, affecting Sliver versions below 1.7.6. The flaw is an uncontrolled resource consumption issue, classified as CWE-770, in the component that decodes PNG payloads received by an open HTTP listener. The decoder accepts PNG data from unauthenticated users without limiting image size or pixel count, and the encoder nonce space is limited to 65,537 possible values. An attacker can exploit this over the network by sending crafted PNG requests to the listener, using the small nonce space to identify or target the expected nonce and then causing the server to decode an excessively large image. The attack requires no authentication or user interaction, but has high complexity because the attacker must account for nonce selection and timing. Successful exploitation can exhaust the memory of the machine running the server, causing a complete loss of availability. For organizations relying on Sliver for command-and-control or operational tooling, this can disrupt incident response, monitoring, or security operations, degrade dependent services, and create operational risk if the listener is reachable from untrusted networks.
We recommend you to update Sliver to version 1.7.6.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]