Affected by GO-2024-2993 and 5 other vulnerabilities

GO-2024-2993: Sliver Allows Authenticated Operator-to-Server Remote Code Execution in github.com/bishopfox/sliver

GO-2026-4280: Sliver Vulnerable to Pre-Auth Memory Exhaustion via NoEncoder Bypass in github.com/bishopfox/sliver

GO-2026-4466: Sliver has DNS C2 OTP Bypass that Allows Unauthenticated Session Flooding and Denial of Service in github.com/bishopfox/sliver

GO-2026-4609: Sliver is Vulnerable to Authenticated Nil-Pointer Dereference through its Handlers in github.com/bishopfox/sliver

GO-2026-4723: Sliver Vulnerable to Authenticated OOM via Memory Exhaustion in mTLS/WireGuard Transports in github.com/bishopfox/sliver

GO-2026-4899: Sliver: Nil Pointer Dereference in tunnelCloseHandler causes panic when a reverse tunnel (rportfwd) close is attempted in github.com/bishopfox/sliver

transport

package

v1.7.2 Latest Latest Go to latest Published: Feb 23, 2026 License: GPL-3.0 Imports: 35 Imported by: 7

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/bishopfox/sliver

Links

Open Source Insights

README ¶

server/transport

Overview

Server-side transports and listener orchestration. Coordinates C2 listener lifecycles and connection routing. Key routines cover local, middleware, mTLS, and tailscale within the transport subsystem.

Go Files

local.go – Implements local transport listeners and helpers.
middleware.go – Shared middleware for transport handler pipelines.
mtls.go – Manages mTLS server listener setup.
tailscale.go – Integrates Tailscale transport support for Sliver.

Documentation ¶

Index ¶

Constants
func ClearTokenCache()
func LocalListener() (*grpc.Server, *bufconn.Listener, error)
func StartMtlsClientListener(host string, port uint16) (*grpc.Server, net.Listener, error)
func StartTsNetClientListener(hostname string, port uint16) (*grpc.Server, net.Listener, error)

Constants ¶

View Source

const (
	Transport contextKey = iota
	Operator
)

View Source

const (

	// ServerMaxMessageSize - Server-side max GRPC message size
	ServerMaxMessageSize = 2 * gb
)

Variables ¶

This section is empty.

Functions ¶

func ClearTokenCache ¶ added in v1.5.0

func ClearTokenCache()

ClearTokenCache - Clear the auth token cache

func LocalListener ¶

func LocalListener() (*grpc.Server, *bufconn.Listener, error)

LocalListener - Bind gRPC server to an in-memory listener, which is typically used for unit testing, but ... it should be fine

func StartMtlsClientListener ¶ added in v1.6.0

func StartMtlsClientListener(host string, port uint16) (*grpc.Server, net.Listener, error)

StartMtlsClientListener - Start a mutual TLS listener

func StartTsNetClientListener ¶ added in v1.6.0

func StartTsNetClientListener(hostname string, port uint16) (*grpc.Server, net.Listener, error)

StartTsNetClientListener - Start a TSNet gRPC listener

Types ¶

This section is empty.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL