SZB-53d371c9ab
EUVD-2026-114237: SNIProxy NULL pointer dereference reported, allowing remote daemon crash
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- SNIProxy
- Product
- SNIProxy
- First seen
Summary
The EUVD listing (CVSS 8.7) says SNIProxy through 0.7.0 has a NULL pointer dereference in resolv_cancel() that lets unauthenticated remote attackers crash the daemon with overlong hostnames. The listing is the only source cited, and no fixed version is named in the excerpt.
If you use SNIProxy
Check the SNIProxy project for a release later than 0.7.0 and upgrade
Restrict exposure of the SNIProxy listener until patched
Monitor the daemon for unexpected crashes or restarts
What the sources say 1
· Mastodon: “sniproxy through 0.7.0 contains a NULL pointer dereference vulnerability in resolv_cancel() that allows remote unauthenticated attackers to crash the daemon by sending overlong hostnames.” Source