A flaw in the DNS channel of the Sliver command‑and‑control framework allows an attacker to send one‑time‑password bootstrap messages without being authenticated. The server accepts and stores these bootstrap requests even when OTP enforcement is turned on. Because the session data has no cleanup or expiry for this flow, the attacker can repeatedly create many sessions, causing the server’s memory consumption to grow without bound, ultimately leading to a denial of service. This is a classic case of resource exhaustion, classified as missing authentication (CWE‑306) and uncontrolled resource consumption (CWE‑400).

The vulnerable product is Sliver from BishopFox. Any installation running a version earlier than 1.7.0 is affected; the fix is available in release 1.7.0 and later.

The CVSS score of 7.5 indicates a high impact with a moderate to high exploitability. The EPSS score of less than 1% suggests that widespread exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, abusing the DNS C2 interface, and requires no prior authentication. Once exploited, the attacker can drive memory exhaustion on the C2 server, disrupting the operational availability of the command‑and‑control infrastructure.