sniproxy: NULL pointer dereference in resolv_cancel() enables denial of service
Summary
sniproxy through version 0.7.0 contains a NULL pointer dereference in resolv_cancel() that can crash the daemon. A remote, unauthenticated attacker can send a TLS SNI name or HTTP Host header of 254 or 255 characters matching a wildcard backend and then close the connection, which terminates the proxy. The impact is limited to availability; no confidentiality or integrity loss is claimed.
Affected
- sniproxy 0.7.0 and earlier (through 0.7.0)
- Reported on the Debian sniproxy 0.7.0-1 package and on a build of the 0.7.0 tag
- Exploitation conditions: a hostname table entry with a wildcard backend is required according to the issue report
Fixed in
Unknown. No upstream release, vendor advisory or distribution fix was found at the time of writing.
- Unverified patches exist in a fork by renaudallard (commits d5d78290c8fe15d9aa12185d2c57739b7b0c6a6b and 17986ba7397297313331297cac3b9eb3f0ba96b7); they have not been reviewed or confirmed as merged upstream
Workaround
- Remove wildcard backends that are not needed
- Restrict access to the listener with a firewall or allowlist where the service is not meant to be public
- Run sniproxy under a supervisor that restarts it, and alert on restarts
Note: these measures are recommendations, not vendor-issued workarounds.
Exploitation
- No known in-the-wild exploitation
- VulDB states that no exploit exists
- A public issue report describes the crash; no public exploit code or Nuclei template was found
- Attack vector: network, no privileges, no user interaction (CVSS 4.0 8.7 per CVE record; NVD analysis pending, status Deferred)
Our recommendation
- Check whether sniproxy is deployed at all
- Check whether it uses wildcard backends and whether it is reachable from the internet
- If both apply, prioritize applying a patch after testing it, or implement a compensating control such as removing wildcard backends or restricting access
- Monitor the service for unexpected restarts
- Confirm the CVSS score against NVD once the analysis is published
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record via cve.threatint.com cve.threatint.com
- VulnCheck advisory www.vulncheck.com
- sniproxy issue #411 github.com
- sniproxy project repository github.com
- Fork commit d5d78290 (unverified patch) github.com
- Fork commit 17986ba7 (unverified patch) github.com
- VulDB entry 429272 vuldb.com
- OffSeq radar entry radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:22.
Original description (NVD)
sniproxy through 0.7.0 contains a NULL pointer dereference vulnerability in resolv_cancel() that allows remote unauthenticated attackers to crash the daemon by sending overlong hostnames. Attackers can send a 254 or 255 character TLS SNI name or HTTP Host header matching a wildcard backend, then close the connection to terminate the proxy.
NVD references (7)
- https://github.com/dlundquist/sniproxy
- https://github.com/dlundquist/sniproxy/blob/1cc625ea41796695a54593d1bd779366b82b8b4e/src/connection.c#L737-L7…
- https://github.com/dlundquist/sniproxy/blob/1cc625ea41796695a54593d1bd779366b82b8b4e/src/resolv.c#L219-L224
- https://github.com/dlundquist/sniproxy/issues/411
- https://github.com/renaudallard/sniproxy/commit/17986ba7397297313331297cac3b9eb3f0ba96b7
- https://github.com/renaudallard/sniproxy/commit/d5d78290c8fe15d9aa12185d2c57739b7b0c6a6b
- https://www.vulncheck.com/advisories/sniproxy-through-0.7.0-null-pointer-dereference-via-resolv-cancel
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.