CVE-2026-119760: sniproxy through 0.7.0 NULL Pointer Dereference via resolv_cancel()

Q: Which deployments are exposed to the crash condition?

Deployments using sniproxy through 0.7.0 are exposed when an overlong TLS SNI name or HTTP Host header matches a wildcard backend.

Q: What does an attacker need to do to trigger the issue?

An unauthenticated remote attacker can send a 254- or 255-character TLS SNI name or HTTP Host header that matches a wildcard backend, then close the connection. No privileges or user interaction are required.

Q: What is the impact of successful exploitation?

Successful exploitation crashes the sniproxy daemon, causing a denial of service. The provided information does not indicate confidentiality or integrity impact.

Published Oct 30, 2026

Updated

sniproxy through 0.7.0 contains a NULL pointer dereference vulnerability in resolvcancel() that allows remote unauthenticated attackers to crash the daemon by sending overlong hostnames. Attackers can send a 254 or 255 character TLS SNI name or HTTP Host header matching a wildcard backend, then close the connection to terminate the proxy.

Affected Software

10 affected componentsFixes available

debian/sniproxy*

debian/sniproxy<=0.6.0-2.1, <=0.6.1+git20240321-0.2, <=0.7.0-1

0.7.0-2

ubuntu/sniproxy*

Event History

Oct 30, 2026

CVE Published

via MITRE·05:19 PM

Data Sourced

via MITRE·05:19 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:17 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·06:17 PM

Affected Software

Frequently Asked Questions

Which deployments are exposed to the crash condition?

Deployments using sniproxy through 0.7.0 are exposed when an overlong TLS SNI name or HTTP Host header matches a wildcard backend.

What does an attacker need to do to trigger the issue?

An unauthenticated remote attacker can send a 254- or 255-character TLS SNI name or HTTP Host header that matches a wildcard backend, then close the connection. No privileges or user interaction are required.

What is the impact of successful exploitation?

Successful exploitation crashes the sniproxy daemon, causing a denial of service. The provided information does not indicate confidentiality or integrity impact.

CVE-2026-119760: sniproxy through 0.7.0 NULL Pointer Dereference via resolv_cancel()

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to the crash condition?

What does an attacker need to do to trigger the issue?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to the crash condition?

What does an attacker need to do to trigger the issue?

What is the impact of successful exploitation?