Description
Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. In affected revisions through 44bc503, when picotls is used as a `client-side TLS stack`, a peer can send a `HelloRetryRequest` followed by a `spoofed Hello message` that causes a null-pointer dereference. This can terminate the consuming process, including a process performing other work, resulting in denial of service. This issue is fixed in commit a06ca41.
Published: 2026-10-30
Score: 6.5 Medium
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Patch
AI Analysis

Impact

The flaw is a null pointer dereference that occurs when picotls is used as a client and receives a specific handshake pattern consisting of a HelloRetryRequest followed by a spoofed Hello message. This pointer error (CWE-476) causes the client library to crash, terminating the consuming process and interrupting service.

Affected Systems

The vulnerability exists in h2o:picotls for all revisions up to and including commit 44bc503. Any deployment that uses picotls as the client‑side TLS stack is impacted. The issue was fixed in the commit a06ca41.

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate‑high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation is not yet observed. An attacker can trigger the failure by establishing a TLS connection to the client and sending the crafted handshake messages over the network. The exploit does not require local privileges or code execution; it results solely in denial of service for the affected process.

Generated by OpenCVE AI on October 30, 2026 at 22:50 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update picotls to the version that includes commit a06ca41 or later.
  • Rebuild any applications that embed picotls so they link against the updated library.
  • If an immediate upgrade is not possible, consider limiting the client’s network exposure or switching to an alternative TLS implementation until a fix is available.

Generated by OpenCVE AI on October 30, 2026 at 22:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 21:15:00 +0000

Type Values Removed Values Added
Description Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. In affected revisions through 44bc503, when picotls is used as a `client-side TLS stack`, a peer can send a `HelloRetryRequest` followed by a `spoofed Hello message` that causes a null-pointer dereference. This can terminate the consuming process, including a process performing other work, resulting in denial of service. This issue is fixed in commit a06ca41.
Title Picotls has NULL pointer dereference during handshake, when running as a client
Weaknesses CWE-476
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-30T21:01:54.818Z

Reserved: 2026-07-07T19:41:00.005Z

Link: CVE-2026-59993

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-30T21:17:13.067

Modified: 2026-10-30T21:17:13.193

Link: CVE-2026-59993

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T23:00:23Z

Weaknesses