Log in Start free

Vulnerability · Published Oct 30, 2026 · Assigned by VulnCheck

CVE-2026-119760sniproxy through 0.7.0 NULL Pointer Dereference via resolv_cancel()

High 7.5

In plain English

A high-severity null pointer dereference in sniproxy from dlundquist. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 58.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

sniproxy through 0.7.0 contains a NULL pointer dereference vulnerability in resolv_cancel() that allows remote unauthenticated attackers to crash the daemon by sending overlong hostnames. Attackers can send a 254 or 255 character TLS SNI name or HTTP Host header matching a wildcard backend, then close the connection to terminate the proxy.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12sniproxyno fix listedDEBIAN-CVE-2026-119760
Debian:13sniproxyno fix listedDEBIAN-CVE-2026-119760
Debian:14sniproxy0.7.0-2DEBIAN-CVE-2026-119760
Ubuntu:22.04:LTSsniproxyno fix listedUBUNTU-CVE-2026-119760
Ubuntu:24.04:LTSsniproxyno fix listedUBUNTU-CVE-2026-119760
Ubuntu:26.04:LTSsniproxyno fix listedUBUNTU-CVE-2026-119760
Ubuntu:26.10sniproxyno fix listedUBUNTU-CVE-2026-119760

Affected products (as reported)

VendorProductVersions
dlundquist sniproxy 0 – through 0.7.0

Weakness: CWE-476 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References