---
id: CVE-2026-119760
title: sniproxy through 0.7.0 NULL Pointer Dereference via resolv_cancel()
summary: >-
  sniproxy through 0.7.0 contains a NULL pointer dereference vulnerability in
  resolv_cancel() that allows remote unauthenticated attackers to crash the
  daemon by sending overlong hostnames. Attackers can send a 254 or 255
  character TLS SNI…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-476
vendor: dlundquist
product: sniproxy
affected:
  - sniproxy <= 0.7.0
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-05T02:25:48.882313Z'
published: '2026-10-30'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T02:25:58.700Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119760'
references:
  - url: 'https://github.com/dlundquist/sniproxy/issues/411'
  - url: >-
      https://github.com/dlundquist/sniproxy/blob/1cc625ea41796695a54593d1bd779366b82b8b4e/src/connection.c#L737-L738
  - url: >-
      https://github.com/dlundquist/sniproxy/blob/1cc625ea41796695a54593d1bd779366b82b8b4e/src/resolv.c#L219-L224
  - url: >-
      https://github.com/renaudallard/sniproxy/commit/d5d78290c8fe15d9aa12185d2c57739b7b0c6a6b
  - url: >-
      https://github.com/renaudallard/sniproxy/commit/17986ba7397297313331297cac3b9eb3f0ba96b7
  - url: 'https://github.com/dlundquist/sniproxy'
  - url: >-
      https://www.vulncheck.com/advisories/sniproxy-through-0.7.0-null-pointer-dereference-via-resolv-cancel
    label: >-
      VulnCheck Advisory: sniproxy through 0.7.0 NULL Pointer Dereference via
      resolv_cancel()
tags:
  - cve.org
epss: 0.00477
epssPercentile: 0.41433
ingestedAt: '2026-11-05T21:36:00.691Z'
---

## Overview

sniproxy through 0.7.0 contains a NULL pointer dereference vulnerability in resolv_cancel() that allows remote unauthenticated attackers to crash the daemon by sending overlong hostnames. Attackers can send a 254 or 255 character TLS SNI name or HTTP Host header matching a wildcard backend, then close the connection to terminate the proxy.

## Affected

- `sniproxy <= 0.7.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.