CVE-2026-59993— Picotls has NULL pointer dereference during handshake, when running as a client

Quick assessment

Affected

h2o picotls

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Picotls 是一个 TLS 协议库，允许用户根据具体使用场景选择不同的加密后端。在受影响的版本（直至提交 44bc503）中，当 Picotls 作为“客户端 TLS 栈”使用时，对等方可发送一个，随后再发送一个伪造的消息，从而触发空指针解引用漏洞。该漏洞会导致运行该库的进程终止，若该进程同时正在执行其他任务，则会造成服务拒绝（DoS）。此问题已在提交 a06ca41 中修复。

CVSS 6.5 · Medium Updated Oct 31, 2026

Possible ATT&CK Techniques 1 AI

T1499.003 · Application Exhaustion Flood

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Picotls has NULL pointer dereference during handshake, when running as a client

Source: CVE Program / CVE List V5

Vulnerability Description

Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. In affected revisions through 44bc503, when picotls is used as a `client-side TLS stack`, a peer can send a `HelloRetryRequest` followed by a `spoofed Hello message` that causes a null-pointer dereference. This can terminate the consuming process, including a process performing other work, resulting in denial of service. This issue is fixed in commit a06ca41.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

空指针解引用

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
h2o	picotls	< a06ca417a16f9126808bf5cabe6c5e6e0f16ecae	-

II. Public POCs for CVE-2026-59993

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-59993

请登录查看更多情报信息。

Other References for CVE-2026-59993 (3)

https://github.com/h2o/picotls/pull/608 x_refsource_MISC
https://github.com/h2o/picotls/security/advisories/GHSA-2xcv-h2pg-m99c x_refsource_CONFIRM
https://github.com/h2o/picotls/commit/a06ca417a16f9126808bf5cabe6c5e6e0f16ecae x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-59993

IV. Related Vulnerabilities

Same product: picotls

Same vendor: h2o

Same weakness: CWE-476