sniproxy through 0.7.0 contains a NULL pointer dereference vulnerability in resolv_cancel() that allows remote unauthenticated attackers to crash the daemon by sending overlong hostnames. Attackers can send a 254 or 255 character TLS SNI name or HTTP Host header matching a wildcard backend, then close the connection to terminate the proxy.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
dlundquist sniproxy unaffected
Version Status Constraints
0 affected ≤ 0.7.0

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Sniproxy Project Subscribe
Sniproxy Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/dlundquist/sniproxy cve-icon cve-icon
https://github.com/dlundquist/sniproxy/blob/1cc625ea41796695a54593d1bd779366b82b8b4e/src/connection.c#L737-L738 cve-icon cve-icon
https://github.com/dlundquist/sniproxy/blob/1cc625ea41796695a54593d1bd779366b82b8b4e/src/resolv.c#L219-L224 cve-icon cve-icon
https://github.com/dlundquist/sniproxy/issues/411 cve-icon cve-icon
https://github.com/renaudallard/sniproxy/commit/17986ba7397297313331297cac3b9eb3f0ba96b7 cve-icon cve-icon
https://github.com/renaudallard/sniproxy/commit/d5d78290c8fe15d9aa12185d2c57739b7b0c6a6b cve-icon cve-icon
https://www.vulncheck.com/advisories/sniproxy-through-0.7.0-null-pointer-dereference-via-resolv-cancel cve-icon cve-icon
History

Fri, 30 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Description sniproxy through 0.7.0 contains a NULL pointer dereference vulnerability in resolv_cancel() that allows remote unauthenticated attackers to crash the daemon by sending overlong hostnames. Attackers can send a 254 or 255 character TLS SNI name or HTTP Host header matching a wildcard backend, then close the connection to terminate the proxy.
Title sniproxy through 0.7.0 NULL Pointer Dereference via resolv_cancel()
First Time appeared Sniproxy Project
Sniproxy Project sniproxy
Weaknesses CWE-476
CPEs cpe:2.3:a:sniproxy_project:sniproxy:*:*:*:*:*:*:*:*
Vendors & Products Sniproxy Project
Sniproxy Project sniproxy
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-30T17:19:53.212Z

Reserved: 2026-10-30T15:35:11.988Z

Link: CVE-2026-119760

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-30T18:17:26.650

Modified: 2026-10-30T18:17:26.650

Link: CVE-2026-119760

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses