High · published February 9, 2026
⚡ Before version 1.7.0, Sliver's DNS command-and-control listener was like a party that never checks IDs — it accepted anyone and everyone! 🎉 Think of it like a restaurant that allows anyone to walk in and place orders without verifying if they're on the guest list. With no way to kick out unwanted guests, the kitchen can quickly run out of supplies, leaving everyone else hungry! An unauthenticated remote attacker can create unlimited sessions, leading to memory exhaustion. This means your command and control framework could crash or slow down, making it impossible to operate effectively and potentially exposing you to further attacks.
Think of it like a restaurant that allows anyone to walk in and place orders without verifying if they're on the guest list. With no way to kick out unwanted guests, the kitchen can quickly run out of supplies, leaving everyone else hungry! This vulnerability allows attackers to send unauthenticated TOTP bootstrap messages to the DNS C2 listener, which then allocates server-side DNS sessions without validating OTP values, even with EnforceOTP enabled. The lack of cleanup or expiry for these sessions can lead to resource exhaustion.
An unauthenticated remote attacker can create unlimited sessions, leading to memory exhaustion. This means your command and control framework could crash or slow down, making it impossible to operate effectively and potentially exposing you to further attacks. Upgrade to Sliver version 1.7.0 or higher immediately. Ensure that your configurations enforce OTP validation correctly and consider implementing session management strategies to prevent memory exhaustion. 📅 You've got this! Follow these steps, and you'll have your Sliver setup running smoothly in no time! 🛡️