CVE-2026-119760— sniproxy through 0.7.0 NULL Pointer Dereference via resolv_cancel()

Quick assessment

Affected

dlundquist sniproxy

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

sniproxy 0.7.0 及更早版本在函数中存在一个空指针解引用漏洞。远程未认证攻击者可通过发送过长的主机名，导致守护进程崩溃。具体而言，攻击者可发送长度为 254 或 255 个字符的 TLS SNI 名称或 HTTP Host 头，使其匹配通配符后端，随后立即关闭连接以终止代理进程。

CVSS 7.5 · High Updated Oct 31, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
dlundquist	sniproxy	`≤ 0.7.0`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

sniproxy through 0.7.0 NULL Pointer Dereference via resolv_cancel()

Source: CVE Program / CVE List V5

Vulnerability Description

sniproxy through 0.7.0 contains a NULL pointer dereference vulnerability in resolv_cancel() that allows remote unauthenticated attackers to crash the daemon by sending overlong hostnames. Attackers can send a 254 or 255 character TLS SNI name or HTTP Host header matching a wildcard backend, then close the connection to terminate the proxy.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

空指针解引用

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
dlundquist	sniproxy	0 ~ 0.7.0	-

II. Public POCs for CVE-2026-119760

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119760

请登录查看更多情报信息。

Other References for CVE-2026-119760 (7)

https://github.com/renaudallard/sniproxy/commit/17986ba7397297313331297cac3b9eb3f0ba96b7 patch
https://github.com/renaudallard/sniproxy/commit/d5d78290c8fe15d9aa12185d2c57739b7b0c6a6b patch
https://github.com/dlundquist/sniproxy/blob/1cc625ea41796695a54593d1bd779366b82b8b4e/src/resolv.c#L219-L224 technical-description
https://github.com/dlundquist/sniproxy product
https://github.com/dlundquist/sniproxy/issues/411 issue-tracking
https://github.com/dlundquist/sniproxy/blob/1cc625ea41796695a54593d1bd779366b82b8b4e/src/connection.c#L737-L738 technical-description
https://www.vulncheck.com/advisories/sniproxy-through-0.7.0-null-pointer-dereference-via-resolv-cancel third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119760

IV. Related Vulnerabilities

Same product: sniproxy

CVE-2023-25076
SNIProxy 安全漏洞

Same weakness: CWE-476