CVE-2026-119760

HIGH 7.5

sniproxy through 0.7.0 NULL Pointer Dereference via resolv_cancel()

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

sniproxy through 0.7.0 contains a NULL pointer dereference vulnerability in resolv_cancel() that allows remote unauthenticated attackers to crash the daemon by sending overlong hostnames. Attackers can send a 254 or 255 character TLS SNI name or HTTP Host header matching a wildcard backend, then close the connection to terminate the proxy.

CWE	CWE-476
Vendor	dlundquist
Product	sniproxy
Published	Oct 30, 2026

Stay Ahead of the Next One

Get instant alerts for dlundquist sniproxy

Be the first to know when new high vulnerabilities affecting dlundquist sniproxy are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

dlundquist / sniproxy

0 ≤ 0.7.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/dlundquist/sniproxy/issues/411 github.com: https://github.com/dlundquist/sniproxy/blob/1cc625ea41796695a54593d1bd779366b82b8b4e/src/connection.c#L737-L738 github.com: https://github.com/dlundquist/sniproxy/blob/1cc625ea41796695a54593d1bd779366b82b8b4e/src/resolv.c#L219-L224 github.com: https://github.com/renaudallard/sniproxy/commit/d5d78290c8fe15d9aa12185d2c57739b7b0c6a6b github.com: https://github.com/renaudallard/sniproxy/commit/17986ba7397297313331297cac3b9eb3f0ba96b7 github.com: https://github.com/dlundquist/sniproxy vulncheck.com: https://www.vulncheck.com/advisories/sniproxy-through-0.7.0-null-pointer-dereference-via-resolv-cancel

Credits

Renaud Allard