sniproxy through 0.7.0 contains a NULL pointer dereference vulnerability in resolv_cancel() that allows remote unauthenticated attackers to crash the daemon by sending overlong hostnames. Attackers can send a 254 or 255 character TLS SNI name or HTTP Host header matching a wildcard backend, then close the connection to terminate the proxy.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

Vendors Products
Sniproxy Project
  • Sniproxy

No data.

No data.

References
Link Providers
https://github.com/dlundquist/sniproxy cve-icon cve-icon
https://github.com/dlundquist/sniproxy/blob/1cc625ea41796695a54593d1bd779366b82b8b4e/src/connection.c#L737-L738 cve-icon cve-icon
https://github.com/dlundquist/sniproxy/blob/1cc625ea41796695a54593d1bd779366b82b8b4e/src/resolv.c#L219-L224 cve-icon cve-icon
https://github.com/dlundquist/sniproxy/issues/411 cve-icon cve-icon
https://github.com/renaudallard/sniproxy/commit/17986ba7397297313331297cac3b9eb3f0ba96b7 cve-icon cve-icon
https://github.com/renaudallard/sniproxy/commit/d5d78290c8fe15d9aa12185d2c57739b7b0c6a6b cve-icon cve-icon
https://www.vulncheck.com/advisories/sniproxy-through-0.7.0-null-pointer-dereference-via-resolv-cancel cve-icon cve-icon
History

Thu, 05 Nov 2026 03:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 30 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Description sniproxy through 0.7.0 contains a NULL pointer dereference vulnerability in resolv_cancel() that allows remote unauthenticated attackers to crash the daemon by sending overlong hostnames. Attackers can send a 254 or 255 character TLS SNI name or HTTP Host header matching a wildcard backend, then close the connection to terminate the proxy.
Title sniproxy through 0.7.0 NULL Pointer Dereference via resolv_cancel()
First Time appeared Sniproxy Project
Sniproxy Project sniproxy
Weaknesses CWE-476
CPEs cpe:2.3:a:sniproxy_project:sniproxy:*:*:*:*:*:*:*:*
Vendors & Products Sniproxy Project
Sniproxy Project sniproxy
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published: 2026-10-30T17:19:53.212Z

Updated: 2026-11-05T02:25:58.700Z

Reserved: 2026-10-30T15:35:11.988Z

Link: CVE-2026-119760

cve-icon Vulnrichment

Updated: 2026-11-05T02:25:54.294Z

cve-icon NVD

Status : Deferred

Published: 2026-10-30T18:17:26.650

Modified: 2026-11-05T03:17:20.457

Link: CVE-2026-119760

cve-icon Redhat

No data.