debian/sniproxy vulnerabilities

Latest debian/sniproxy CVEs

Newest publication first

1. CVE-2026-119760 sniproxy through 0.7.0 NULL Pointer Dereference via resolv_cancel()

   Published 2026-10-30

   High·CVSS 8.7 EPSS 0.48%

   sniproxy through 0.7.0 contains a NULL pointer dereference vulnerability in resolv_cancel() that allows remote unauthenticated attackers to crash the daemon by sending overlong hostnames. Attackers can send a 254 or 255 character TLS SNI name or HTTP Host header matching a wildca...

2. DSA-5413-1 sniproxy - security update

   Published 2023-05-26

   Unknown

3. DLA-3406-1 sniproxy - security update

   Published 2023-04-30

   Unknown

4. CVE-2023-25076 A buffer overflow vulnerability exists in the handling of wildcard backend hosts of SNIProxy 0.6.0-2 and the master branch (commit: 822bb80df9b7b345cc9eba55df74a07b498819ba). A specially crafted HTTP....

   Published 2023-03-30

   Critical·CVSS 9.8 EPSS 65.8%

   A buffer overflow vulnerability exists in the handling of wildcard backend hosts of SNIProxy 0.6.0-2 and the master branch (commit: 822bb80df9b7b345cc9eba55df74a07b498819ba). A specially crafted HTTP or TLS packet can lead to arbitrary code execution. An attacker could send a mal...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.