Live › vulnerability › CVE-2026-119760
sniproxy through 0.7.0 has a NULL pointer dereference in resolv_cancel() that an unauthenticated remote client can trigger. Sending a 254 or 255 character TLS SNI name or HTTP Host header matching a wildcard backend, then closing the connection, terminates the proxy.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 18:55 UTC. All times on this page are UTC.
Teams running sniproxy 0.7.0 (including the Debian 0.7.0-1 package) with a wildcard backend entry and DNS resolution enabled. Any unauthenticated client can crash the proxy by sending a 254 or 255 character SNI or Host name and closing the connection. If you only use fixed backends or do not run sniproxy, you can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| sniproxy | generic | <= 0.7.0 | – |
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
sniproxy through 0.7.0 contains a NULL pointer dereference vulnerability in resolv_cancel() that allows remote unauthenticated attackers to crash the daemon by sending overlong hostnames. Attackers can send a 254 or 255 character TLS SNI name or HTTP Host header matching a wildcard backend, then close the connection to terminate the proxy.
This page as .md · .json · in your agent: get_signal("CVE-2026-119760")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.