sniproxy EUVD-2026-114237

Exploitation requires that sniproxy be configured with a wildcard backend that triggers asynchronous DNS resolution for the requested name, and that the attacker can reach the TLS/HTTP listener. The attacker sends a 254- or 255-character TLS SNI name or HTTP Host header matching that wildcard backend, then closes the connection mid-resolution so the cancel path runs on an uninitialized query handle. No authentication or user interaction is needed (PR:N/UI:N). The limiting factor is the configuration dependency: deployments without a wildcard/resolving backend that produces an unset query_handle may not reach the vulnerable resolv_cancel() path, and impact is confined to a crash (availability loss) with no code execution or data exposure.

Signals align on a moderate-to-high availability risk with no confidentiality or integrity exposure. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated trigger, and the only impact is VA:H - the daemon crashes. There is no confirmed active exploitation: CISA KEV status is not indicated, and no EPSS probability was supplied, so widespread-exploitation likelihood cannot be quantified from the input. No working exploit code is marked as available; the references are a vendor issue, the vulnerable source lines, fork patch commits, and a VulnCheck advisory. The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a real but non-emergency priority. The practical risk is bounded by impact type: this is a pure denial-of-service (crash) against a reverse/SNI proxy, not RCE or data exposure, but because it is remote, unauthenticated, trivially repeatable, and takes down the proxy, it should be patched promptly where sniproxy is exposed and uses a wildcard backend. The CVSS 3.1 severity ceiling for a crash-only, scope-unchanged bug keeps this below RCE-class urgency despite the network vector.

A remote, unauthenticated attacker opens a connection to an internet-facing sniproxy (TLS or HTTP) and sends a 254- or 255-character SNI name or HTTP Host header that matches a wildcard backend requiring DNS resolution, then abruptly closes the connection. The close path calls resolv_cancel() on an uninitialized/NULL query handle, dereferencing a NULL pointer and crashing the daemon, dropping all proxied traffic. No public working exploit is marked as available, but the trigger is simple and reliably described in the vendor issue and VulnCheck advisory.