Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/bishopfox/sliver

9 known vulnerabilities (2 high, 5 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
9 · 2 high, 5 medium, 1 low
Registry
pkg.go.dev

Advisories 9

  • CVE-2026-34227Medium 5.9

    Sliver One-Click Remote Access: Insecure CORS & Unauthenticated MCP Interface

    Affected: fixed in 1.7.4.

  • CVE-2026-32941Medium 5.7

    Sliver Vulnerable to Authenticated OOM via Memory Exhaustion in mTLS/WireGuard Transports

    Affected: through 1.7.3; all versions.

  • Sliver: Authenticated Nil-Pointer Dereference in Handlers

    Affected: all versions; through 1.7.3.

  • Sliver has a DNS C2 OTP Bypass Allows Unauthenticated Session Flooding and Denial of Service

    Affected: all versions; fixed in 1.6.12.

  • CVE-2026-25760Medium 6.5

    Website Path Traversal / Arbitrary File Read (Authenticated) in Sliver

    Affected: fixed in 1.6.11.

  • CVE-2025-27093Medium 6.3

    Sliver does not restricted traffic between Wireguard clients.

    Affected: fixed in 1.5.44; fixed in 1.5.44.

  • CVE-2025-27090Medium 6.9

    Server-Side Request Forgery (SSRF) in sliver teamserver

    Affected: from 1.5.26, fixed in 1.5.43.

  • BishopFox Sliver Authenticated Remote Code Execution

    Affected: from 1.5.40, fixed in 1.6.0; from 1.5.40.

  • Sliver from v1.5.x to v1.5.39 has an improper cryptographic implementation, which allows attackers to execute a man-in-the-middle attack…

    Affected: from 1.5.0, fixed in 1.5.40.