UBUNTU-CVE-2026-119760: Null Pointer Dereference
sniproxy through 0.7.0 contains a NULL pointer dereference vulnerability in resolvcancel() that allows remote unauthenticated attackers to crash the daemon by sending overlong hostnames. Attackers can send a 254 or 255 character TLS SNI name or HTTP Host header matching a wildcard backend, then close the connection to terminate the proxy.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
sniproxy deployments through version 0.7.0 are exposed when an attacker can reach the daemon and submit a TLS SNI name or HTTP Host header that matches a wildcard backend.
What must an attacker do to trigger the crash?
No authentication or user interaction is required. The attacker sends a 254- or 255-character TLS SNI name or HTTP Host header matching a wildcard backend, then closes the connection.
What is the impact of successful exploitation?
Successful exploitation terminates the sniproxy daemon, causing a denial of service. The provided information indicates no confidentiality or integrity impact.
How can I determine whether a system is potentially affected?
Check whether the system runs sniproxy version 0.7.0 or earlier and is configured with wildcard backends that can be reached by untrusted clients. Such systems may be vulnerable to the described crash condition.