CVE-2026-119760 Details
Description
sniproxy through 0.7.0 contains a NULL pointer dereference vulnerability in resolv_cancel() that allows remote unauthenticated attackers to crash the daemon by sending overlong hostnames. Attackers can send a 254 or 255 character TLS SNI name or HTTP Host header matching a wildcard backend, then close the connection to terminate the proxy.
A NULL pointer dereference vulnerability has been identified in SNIProxy versions through 0.7.0. This vulnerability occurs in the 'resolv_cancel()' function, where the application crashes due to improper handling of overlong hostnames. Remote, unauthenticated attackers can exploit this by sending TLS SNI names or HTTP Host headers that are 254 or 255 characters long, matching a wildcard backend. After sending the oversized hostname, the attacker can close the connection, leading to a crash of the SNIProxy daemon.
Users can upgrade to SNIProxy version 0.7.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| dlundquist sniproxy | <= 0.7.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |