{"id":"CVE-2026-59993","aliases":["EUVD-2026-114509","GHSA-2xcv-h2pg-m99c"],"status":"published","title":"Picotls has NULL pointer dereference during handshake, when running as a client","description":"Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. In affected revisions through 44bc503, when picotls is used as a `client-side TLS stack`, a peer can send a `HelloRetryRequest` followed by a `spoofed Hello message` that causes a null-pointer dereference. This can terminate the consuming process, including a process performing other work, resulting in denial of service. This issue is fixed in commit a06ca41.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00247,"percentile":0.16126,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-476"],"published":"2026-10-30T21:01:54Z","modified":"2026-11-06T18:24:13Z","products":[{"vendor":"h2o","product":"picotls"}],"references":[{"url":"https://github.com/h2o/picotls/security/advisories/GHSA-2xcv-h2pg-m99c","tags":["x_refsource_CONFIRM","advisory"]},{"url":"https://github.com/h2o/picotls/pull/608","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/h2o/picotls/commit/a06ca417a16f9126808bf5cabe6c5e6e0f16ecae","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59993.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59993","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-59993","title":"Picotls has NULL pointer dereference during handshake, when running as a client","description":"Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. In affected revisions through 44bc503, when picotls is used as a `client-side TLS stack`, a peer can send a `HelloRetryRequest` followed by a `spoofed Hello message` that causes a null-pointer dereference. This can terminate the consuming process, including a process performing other work, resulting in denial of service. This issue is fixed in commit a06ca41.","status":"published","published":"2026-10-30T21:01:54.818Z","modified":"2026-11-06T18:24:13.15Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-476"],"updated_at":"2026-11-06T19:59:20.130638Z"}],"euvd":[{"id":"EUVD-2026-114509","description":"Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. In affected revisions through 44bc503, when picotls is used as a `client-side TLS stack`, a peer can send a `HelloRetryRequest` followed by a `spoofed Hello message` that causes a null-pointer dereference. This can terminate the consuming process, including a process performing other work, resulting in denial of service. This issue is fixed in commit a06ca41.","status":"published","published":"2026-10-30T21:01:54Z","modified":"2026-11-06T18:24:13Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-06T19:05:52.672747Z"}],"nvd":[{"id":"CVE-2026-59993","description":"Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. In affected revisions through 44bc503, when picotls is used as a `client-side TLS stack`, a peer can send a `HelloRetryRequest` followed by a `spoofed Hello message` that causes a null-pointer dereference. This can terminate the consuming process, including a process performing other work, resulting in denial of service. This issue is fixed in commit a06ca41.","status":"published","published":"2026-10-30T21:17:13.067Z","modified":"2026-11-06T19:17:52.53Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-476"],"updated_at":"2026-11-06T22:02:15.900703Z"}],"osv":[{"id":"CVE-2026-59993","title":"Picotls has NULL pointer dereference during handshake, when running as a client","description":"Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. In affected revisions through 44bc503, when picotls is used as a `client-side TLS stack`, a peer can send a `HelloRetryRequest` followed by a `spoofed Hello message` that causes a null-pointer dereference. This can terminate the consuming process, including a process performing other work, resulting in denial of service. This issue is fixed in commit a06ca41.","status":"published","published":"2026-10-30T21:01:54.818Z","modified":"2026-11-08T02:30:57.746388908Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-476"],"updated_at":"2026-11-07T03:08:08.148548Z"}]}}