Sniproxy
Monthly
NULL pointer dereference in sniproxy through 0.7.0 lets remote unauthenticated attackers crash the daemon by sending a 254- or 255-character TLS SNI name or HTTP Host header that matches a wildcard backend, then closing the connection while asynchronous DNS resolution is still in flight. Impact is availability-only - the proxy terminates with no confidentiality or integrity exposure and no code execution path. Exploitation is configuration-dependent: the deployment must have a wildcard backend that triggers asynchronous resolution for attacker-supplied names and must expose the TLS/HTTP listener to the attacker; no public exploit code was identified at time of analysis, and the case is not in CISA KEV.
A buffer overflow vulnerability exists in the handling of wildcard backend hosts of SNIProxy 0.6.0-2 and the master branch (commit: 822bb80df9b7b345cc9eba55df74a07b498819ba). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
NULL pointer dereference in sniproxy through 0.7.0 lets remote unauthenticated attackers crash the daemon by sending a 254- or 255-character TLS SNI name or HTTP Host header that matches a wildcard backend, then closing the connection while asynchronous DNS resolution is still in flight. Impact is availability-only - the proxy terminates with no confidentiality or integrity exposure and no code execution path. Exploitation is configuration-dependent: the deployment must have a wildcard backend that triggers asynchronous resolution for attacker-supplied names and must expose the TLS/HTTP listener to the attacker; no public exploit code was identified at time of analysis, and the case is not in CISA KEV.
A buffer overflow vulnerability exists in the handling of wildcard backend hosts of SNIProxy 0.6.0-2 and the master branch (commit: 822bb80df9b7b345cc9eba55df74a07b498819ba). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.