Skip to content
Fencer Intel
high —

GHSA-2phg-qgmm-r638 json

Sliver has Potential Zip Bomb Denial of Service in GzipEncoder

published 8mo ago modified 8mo ago also GO-2026-4548

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

### Summary

GzipEncoder does not limit output size when processing compressed data. This allows unauthenticated remote attackers to crash sliver server by sending a http request with highly compressed gzip data (aka zip bomb).

### Details

In `util/encoders/gzip.go`, `Decode()` method decompresses given data by reading the entire gzip buffer at once without limiting output size.

### PoC

```python data = gzip.compress(bytes(1024 * 1024 * 1024)) * 16 requests.post(f"http://172.17.0.2/{nonce}", data=data) ```

### Impact

Unauthenticated remote attackers can exhaust memory and cpu resource of sliver server and crash it when they have GzipEncoderID, which can be easily retrived from implant's http traffic, or by brute-forcing.

A fixed version is available at https://github.com/BishopFox/sliver/releases/tag/v1.7.2.

Patch / fix

  • go github.com/bishopfox/sliver 1.7.2

Is GHSA-2phg-qgmm-r638 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
go github.com/bishopfox/sliver
<1.7.2
1.7.2

Classification

Weakness
  • CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.