CVE-2026-119760

sniproxy: sniproxy through 0.7.0 contains a NULL pointer dereference vulnerability in resolv_cancel() that allows remote unauth...

CVE-2026-119760 is fixed in sniproxy on 1 platform by DEBIAN-CVE-2026-119760 (version 0.7.0-2), released November 5, 2026. It is not reported as exploited. Patch Radar priority: Routine.

Routine

CVSS

n/a

No vendor severity

Exploitation

None reported

No vendor assessment

CISA KEV

Not listed

Not in the Known Exploited Vulnerabilities catalog

EPSS

0.0048

41st percentile

sniproxy through 0.7.0 contains a NULL pointer dereference vulnerability in resolv_cancel() that allows remote unauthenticated attackers to crash the daemon by sending overlong hostnames. Attackers can send a 254 or 255 character TLS SNI name or HTTP Host header matching a wildcard backend, then close the connection to terminate the proxy.

Where it's fixed

Product	Fixed in	Fix	Released
Linux
sniproxy · Debian 14	0.7.0-2	DEBIAN-CVE-2026-119760	Nov 5, 2026

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.