Merlin HTTP/2 Files

Security

• Fixed GHSA-j4v3-8vg5-7p7g: a rogue agent could create a cycle in the peer-to-peer link graph (e.g. a self-link), which the server walked with mutually recursive getBase/getDelegates calls that had no cycle detection, overflowing the goroutine stack and crashing the entire C2. The link-graph walk now carries a visited set and Agent.AddLink rejects self-links and duplicates.
• Hardened four related issues found during remediation:
• The OPAQUE authentication proof is now verified before an agent is marked authenticated.
• ServerAuthenticateComplete guards against a nil/uninitialized server.
• Wrong-type gob payloads from agents are rejected instead of panicking the handler goroutine.
• Out-of-order SOCKS messages are buffered in a bounded reorder buffer instead of being requeued in a tight loop.

Changed

• Upgraded the minimum version of go to v1.27.2
• Migrated the H2C listener from golang.org/x/net/http2+h2c to the standard library http.Server.Protocols
• Upgraded the following libraries:
• github.com/Ne0nd0g/merlin-message v1.3.0 => v1.4.0
• github.com/go-jose/go-jose/v3 v3.0.4 => v3.0.5
• github.com/quic-go/quic-go v0.50.1 => v0.63.0
• golang.org/x/net v0.39.0 => v0.60.0
• golang.org/x/sync v0.13.0 => v0.23.0
• google.golang.org/grpc v1.63.2 => v1.83.2 (pinned <1.84; v1.84.0 regressed GO-2026-6443)
• google.golang.org/protobuf v1.36.5 => v1.36.12
• Modernized CI: dropped Qodana, kept CodeQL, added golangci-lint + govulncheck + gosec

Fixed

• SOCKS unknown-command error was overwritten before use (staticcheck SA4006)
• Listener PSK server-set error was swallowed (ineffassign)

The data/bin directory contains compiled versions of the Merlin CLI and Merlin Agents

Merlin documentation and Wiki can be found here

The compressed files have a password of merlin