CVE-2026-119760
Received Received - Intake

NULL Pointer Dereference in sniproxy via Overlong Hostname

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
sniproxy through 0.7.0 contains a NULL pointer dereference vulnerability in resolv_cancel() that allows remote unauthenticated attackers to crash the daemon by sending overlong hostnames. Attackers can send a 254 or 255 character TLS SNI name or HTTP Host header matching a wildcard backend, then close the connection to terminate the proxy.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119760
EUVD
EUVD-2026-114237

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
dlundquist sniproxy 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

sniproxy through 0.7.0 has a NULL pointer dereference flaw in the resolv_cancel() function. Remote attackers can exploit this by sending an overly long hostname (254 or 255 characters) in a TLS SNI name or HTTP Host header that matches a wildcard backend. Closing the connection afterward crashes the proxy daemon.

Detection Guidance

Detect this vulnerability by monitoring sniproxy for crashes when processing long hostnames or wildcard backends. Check logs for NULL pointer dereference errors or daemon termination after receiving 254-255 character SNI names or HTTP Host headers.

Impact Analysis

This vulnerability allows remote unauthenticated attackers to crash the sniproxy service, causing a denial of service. It does not enable data theft or code execution but disrupts proxy functionality for affected services.

Mitigation Strategies

Upgrade sniproxy to a patched version beyond 0.7.0. If upgrading is not possible, implement network-level mitigations like rate limiting or blocking oversized SNI/Host headers. Disable wildcard backends if unused.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119760. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart