---
id: "CVE-2026-119760"
kind: "vulnerability"
aliases: ["CVE-2026-119760"]
title: "sniproxy: overlong hostname triggers NULL dereference that crashes the daemon"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "sniproxy", "fixed": [], "affected": "<= 0.7.0", "ecosystem": "generic"}]
ecosystems: []
tags: ["dos", "reverse-proxy", "runtime", "self-hosted", "sniproxy"]
not_affected_if: ["dns-resolution-disabled", "no-wildcard-backend", "not-running-sniproxy"]
published_at: "2026-10-30T18:17:26+00:00"
first_seen_at: "2026-10-30T18:55:29+00:00"
updated_at: "2026-10-30T19:00:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119760", "first_seen_at": "2026-10-30T18:55:29+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-30T19:00:25+00:00"}]
---

# sniproxy: overlong hostname triggers NULL dereference that crashes the daemon

sniproxy through 0.7.0 has a NULL pointer dereference in resolv_cancel() that an unauthenticated remote client can trigger. Sending a 254 or 255 character TLS SNI name or HTTP Host header matching a wildcard backend, then closing the connection, terminates the proxy.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- generic:sniproxy affected <= 0.7.0 fixed ?

## How to check

- Run sniproxy -V or check your package (Debian 0.7.0-1 is affected).
- Check the config for a table entry whose backend is a wildcard '*' (e.g. '.* *'); without a wildcard backend the reported trigger path does not apply.
- Check sniproxy was built with DNS resolution (--enable-dns); the crash is in the resolver path.

## Timeline

- 2026-10-30T18:55:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119760
- 2026-10-30T19:00:25+00:00 analyst — Upstream issue #411 (open, maintainer's own tracker) confirms: 254/255-char SNI/Host matching a wildcard backend ('*' target) -> valid_hostname accepts up to 255, libudns rejects >253, query handle NULL, client close calls resolv_cancel(NULL). No upstream release or fix; only a fork (renaudallard) commit guards the call, and that commit message describes it as use-after-free guard, so not verified as the fix. Affected 0.7.0 (Debian 0.7.0-1 built with --enable-dns). Nothing marked verified.

## Documents

- [advisory] sniproxy issue #411: NULL resolv_cancel on 254/255-char hostname (open) https://github.com/dlundquist/sniproxy/issues/411
- [describes] VulnCheck advisory: sniproxy through 0.7.0 NULL Pointer Dereference via resolv_cancel() https://www.vulncheck.com/advisories/sniproxy-through-0.7.0-null-pointer-dereference-via-resolv-cancel
- [mentions] renaudallard/sniproxy fork commit guarding resolv_cancel (not upstream) https://github.com/renaudallard/sniproxy/commit/d5d78290c8fe15d9aa12185d2c57739b7b0c6a6b

## From the sources

sniproxy through 0.7.0 contains a NULL pointer dereference vulnerability in resolv_cancel() that allows remote unauthenticated attackers to crash the daemon by sending overlong hostnames. Attackers can send a 254 or 255 character TLS SNI name or HTTP Host header matching a wildcard backend, then close the connection to terminate the proxy.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_