CVE-2026-119760 in SniProxy
Summary
by MITRE • 10/30/2026
sniproxy through 0.7.0 contains a NULL pointer dereference vulnerability in resolv_cancel() that allows remote unauthenticated attackers to crash the daemon by sending overlong hostnames. Attackers can send a 254 or 255 character TLS SNI name or HTTP Host header matching a wildcard backend, then close the connection to terminate the proxy.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in sniproxy versions through 0.7.0 represents a critical stability issue rooted in improper input validation within the library's DNS resolution cancellation routine. Specifically, the flaw resides in the resolv_cancel function, which is responsible for handling asynchronous domain name lookups initiated by the proxy when establishing connections to backend servers. When an attacker sends a request containing a hostname that exceeds standard length limits or matches a wildcard configuration pattern, the internal logic fails to properly manage memory pointers associated with pending resolution tasks. This oversight leads directly to a NULL pointer dereference condition, causing the application process to terminate unexpectedly due to a segmentation fault or similar fatal exception triggered by accessing invalid memory addresses.
From an operational perspective, this vulnerability enables remote unauthenticated denial of service attacks against any instance of sniproxy configured to handle TLS Server Name Indication extensions or HTTP Host headers that align with wildcard backend definitions. An adversary does not require authentication credentials nor do they need to establish a fully valid connection; instead, the attack vector is triggered simply by sending an overlong hostname string followed immediately by closing the TCP connection. This sequence exploits the race condition and memory management errors within the resolution cancellation logic, allowing even low-skilled attackers to disrupt service availability for all users relying on that specific proxy instance. The impact extends beyond simple downtime, as frequent crashes can lead to data loss in transit if connections are abruptly terminated without proper graceful shutdown procedures being implemented by higher-level orchestration tools.
In terms of industry classification standards, this vulnerability aligns with CWE-476, which denotes a NULL Pointer Dereference error where software fails to check for null pointers before using them as valid memory addresses. Furthermore, the attack methodology corresponds to MITRE ATT&CK technique T1499, specifically Endpoint Denial of Service via application exhaustion or crash mechanisms. The exploitation relies on sending malformed input that triggers an internal exception rather than executing arbitrary code, making it a pure availability-focused threat vector against infrastructure components managing reverse proxy traffic for multiple virtual hosts based on SNI or Host header values.
Mitigation strategies primarily involve upgrading to sniproxy version 0.7.1 or later where the developers have addressed this specific memory management flaw by implementing robust checks before dereferencing pointers during cancellation operations. In environments where immediate patching is not feasible, administrators should consider deploying a front-end firewall rule that restricts the maximum length of HTTP Host headers and TLS SNI extensions accepted from external sources to prevent excessively long strings from reaching the application layer. Additionally, configuring process managers like systemd or supervisord with automatic restart policies can help maintain service availability despite repeated crash attempts, although this serves as a compensating control rather than a fix for the underlying code defect. Regular security audits and static analysis tools should be employed during development cycles to detect similar pointer safety issues before deployment in production environments handling untrusted network inputs.