{"affected":[{"product":"sliver","source":"CNA: GitHub_M","vendor":"BishopFox","versions":[{"status":"affected","version":"< 1.7.6"}]},{"defaultStatus":"unaffected","ecosystem":"Go","packageName":"github.com/BishopFox/sliver","product":"github.com/BishopFox/sliver","source":"OSV GHSA-663m-7x7m-g4fw","vendor":"","versions":[{"events":[{"introduced":"0"},{"fixed":"1.7.6"}],"lessThan":"1.7.6","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-77622","cwes":["CWE-770"],"description":"Sliver is a command and control framework. Prior to 1.7.6, an HTTP(S) listener using the PNG encoder accepts attacker-controlled PNG dimensions without an effective decoded-size or pixel limit in util/encoders/images.go, while the listener nonce space implemented in server/encoders/encoders.go is small enough to search remotely. An unauthenticated attacker who identifies a valid nonce can submit a highly compressed image to PNGEncoder.Decode, where it expands during png.Decode, exhausting server memory and causing a complete loss of availability. This vulnerability is fixed in 1.7.6.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.2,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1793911959075,"publishedAt":1793911959075,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/BishopFox/sliver/security/advisories/GHSA-663m-7x7m-g4fw"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/BishopFox/sliver/commit/80273462bd8b2a3cd724d2d6d0301a0cabfa977d"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/BishopFox/sliver/releases/tag/v1.7.6"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-663m-7x7m-g4fw"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-663m-7x7m-g4fw"}],"remediation":[{"kind":"fix","source":"OSV GHSA-663m-7x7m-g4fw","text":"github.com/BishopFox/sliver (Go): OSV reports a fixed version 1.7.6. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-663m-7x7m-g4fw"}],"revision":"e8ac2bb8705d0c017141238e4179f4bd019e5f4e0ee70c8e1bccf2683cd73811","sources":[{"modifiedAt":1793911959075,"name":"CNA: GitHub_M","retrievedAt":1793913870391,"url":"https://www.cve.org/CVERecord?id=CVE-2026-77622"},{"modifiedAt":1792446045149,"name":"OSV / GitHub Security Advisories","retrievedAt":1793913872020,"url":"https://osv.dev/vulnerability/GHSA-663m-7x7m-g4fw"}],"ssvc":null,"status":"published","title":"Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder","updatedAt":1793913872020}