This vulnerability is a NULL pointer dereference that occurs in the resolv_cancel() function of sniproxy. When an attacker sends an overly long hostname—specifically a 254 or 255 character TLS Server Name Indication (SNI) or HTTP Host header that matches a configured wildcard backend—the resolver attempts to cancel the query and dereferences a null pointer, causing the sniproxy process to terminate abruptly. Because the de‑allocation logic does not guard against this invalid state, the crash is unconditional and does not allow the attacker to execute arbitrary code. The impact is a denial‑of‑service condition for the proxy service, which can affect all client connections routed through the daemon.

The affected product is sniproxy ever from its earliest releases up to version 0.7.0, as shipped by the project maintainers. No specific platform or operating‑system dependencies are mentioned; the flaw exists regardless of the underlying host environment as long as the vulnerable sniproxy binary is running.

The CVSS score of 8.7 indicates a high severity vulnerability with remote unauthenticated exploitation. The EPSS score is not available, so the exact likelihood of exploitation is uncertain, but the bug can be triggered with a simple network connection and does not require privileged access. The vulnerability is not listed in the CISA KEV catalog, so no publicly documented exploits are known. Attackers can remotely crash the daemon by sending a specially crafted, long hostname string, leading to service disruption. Because the crash is deterministic and the attacker can control the request shape, the risk to availability is significant, especially for critical proxy deployments without automated failover.