CVE-2026-25791: 
vulnerability analysis and mitigation

CVE-2026-25791 is a DNS C2 OTP bypass vulnerability in BishopFox's Sliver command-and-control framework that allows unauthenticated remote attackers to cause denial of service through memory exhaustion. The DNS C2 listener accepts TOTP bootstrap messages without validating OTP values — even when EnforceOTP is enabled — and allocates server-side DNS sessions with no cleanup or expiry path. All versions up to and including 1.6.11 are affected; the vulnerability was fixed in version 1.7.0. It was published on February 6, 2026, with a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, BishopFox Advisory).

The root cause is a combination of CWE-306 (Missing Authentication for Critical Function) and CWE-400 (Uncontrolled Resource Consumption). Specifically, server/c2/dns.go routes DNSMessageType_TOTP messages directly to the bootstrap handler (handleHello, lines 490–521) without enforcing OTP validation, despite the EnforceOTP flag being stored at lines 84–90. The sessions.Store call at line 495 persists each allocated session with no lifecycle control, meaning an attacker can send a continuous loop of minimal protobuf-encoded DNS queries of type TOTP to drive unbounded in-memory session growth. No authentication, privileges, or user interaction are required — only network access to the DNS listener (GitHub Advisory, BishopFox Advisory).

Successful exploitation results in a denial-of-service condition against the Sliver C2 server through memory exhaustion, causing service slowdown or complete instability. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Because Sliver is a red team and adversary simulation tool, disruption of the C2 server could interrupt active penetration testing engagements or, if exploited against a threat actor's infrastructure, neutralize their command-and-control capability (GitHub Advisory).

1. Reconnaissance: Identify a Sliver C2 server with an active DNS C2 listener by probing for DNS responses on the target domain or IP, or by identifying exposed Sliver infrastructure through passive DNS or threat intelligence sources.
2. Craft TOTP bootstrap message: Construct a minimal protobuf message of type DNSMessageType_TOTP (as defined in protobuf/dnspb/dns.proto:22). The base32-encoded payload baa8 represents such a minimal TOTP-type message.
3. Send repeated DNS queries: Execute a continuous loop of DNS A-record queries embedding the crafted payload as a subdomain label against the Sliver DNS listener:

   while true; do dig +short @<target_dns_server> baa8.<c2_domain>. A >/dev/null; done

4. Trigger unbounded session allocation: Each query causes handleHello in server/c2/dns.go to allocate a new server-side session via sessions.Store without OTP validation or session expiry, growing in-memory state continuously.
5. Achieve denial of service: Sustain the query loop until the Sliver server process exhausts available memory, resulting in service degradation or crash (GitHub Advisory, BishopFox Advisory).

• Network: High volume of DNS A-record queries to the Sliver C2 domain with base32-encoded subdomain labels (e.g., baa8.<c2_domain>); repeated queries from a single or rotating source IP targeting the DNS listener port (UDP/TCP 53).
• Logs: Repeated handleHello bootstrap/session-allocation log entries in the Sliver server logs without corresponding legitimate implant activity; anomalous spike in session creation events in a short time window.
• Process: Continuously rising memory usage of the Sliver server process (sliver-server) observable via system monitoring tools (e.g., top, htop, or process memory metrics); eventual OOM-killer events or process crashes in system logs (/var/log/syslog or dmesg).
• File System: No specific file artifacts expected, as the attack is entirely in-memory (GitHub Advisory).

Upgrade Sliver to version 1.7.0 or later, which includes the fix for DNS DoS (PR #2164) that enforces OTP validation in the bootstrap path and adds session lifecycle controls (Sliver v1.7.0 Release). No official configuration-based workaround is provided; however, operators can reduce exposure by restricting network access to the DNS C2 listener to known implant IP ranges using firewall rules, or by disabling the DNS C2 listener if not actively required. Monitoring for anomalous DNS query volumes and memory growth in the Sliver server process is recommended as a compensating control until patching is complete (BishopFox Advisory).

The vulnerability was reported by researcher xtle0o0 and published by BishopFox maintainer moloch-- on February 6, 2026. A Bluesky post referencing the advisory was noted shortly after disclosure. The vulnerability was included in a weekly threat landscape digest by Hawk-Eye, and Red Hat tracked it via their CVE database. No major media coverage or significant community controversy has been identified beyond standard vulnerability tracking (BishopFox Advisory, Hawk-Eye Digest).