Description
sniproxy through 0.7.0 contains a NULL pointer dereference vulnerability in resolv_cancel() that allows remote unauthenticated attackers to crash the daemon by sending overlong hostnames. Attackers can send a 254 or 255 character TLS SNI name or HTTP Host header matching a wildcard backend, then close the connection to terminate the proxy.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| dlundquist | sniproxy | ≤ 0.7.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | sniproxy | 0.7.0-2 | — |
| Debian 13 | sniproxy | No fix yet | — |
| Debian 12 | sniproxy | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | sniproxy | No fix yet | — |
| Ubuntu 26.04 LTS | sniproxy | No fix yet | — |
| Ubuntu 24.04 LTS | sniproxy | No fix yet | — |
| Ubuntu 22.04 LTS | sniproxy | No fix yet | — |
| Ubuntu 20.04 LTS | sniproxy | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | sniproxy | No fix yet | — |
References
- https://github.com/dlundquist/sniproxy/issues/411 issue-tracking
- https://github.com/dlundquist/sniproxy/blob/1cc625ea41796695a54593d1bd779366b82b8b4e/src/connection.c#L737-L738 technical-description
- https://github.com/dlundquist/sniproxy/blob/1cc625ea41796695a54593d1bd779366b82b8b4e/src/resolv.c#L219-L224 technical-description
- https://github.com/renaudallard/sniproxy/commit/d5d78290c8fe15d9aa12185d2c57739b7b0c6a6b patch
- https://github.com/renaudallard/sniproxy/commit/17986ba7397297313331297cac3b9eb3f0ba96b7 patch
- https://github.com/dlundquist/sniproxy product
- VulnCheck Advisory: sniproxy through 0.7.0 NULL Pointer Dereference via resolv_cancel() third-party-advisory