CVE-2026-59993

MediumCVSS 6.5/10Last modified Nov 6, 2026

Description

Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. In affected revisions through 44bc503, when picotls is used as a `client-side TLS stack`, a peer can send a `HelloRetryRequest` followed by a `spoofed Hello message` that causes a null-pointer dereference. This can terminate the consuming process, including a process performing other work, resulting in denial of service. This issue is fixed in commit a06ca41.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

VendorProductVersions
h2opicotls< a06ca417a16f9126808bf5cabe6c5e6e0f16ecae

References

Timeline

Published
Oct 30, 2026
Last modified
Nov 6, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-599944.3EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an unauthenticated remote attacker can send an emailCVE-2026-599955.4sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attackerCVE-2026-599965.4scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinaCVE-2026-599975.4internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-lCVE-2026-599986.5sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in WindoCVE-2026-599997.5In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.CVE-2026-60004.3A vulnerability was found in code-projects Online Library Management System 1.0. Affected is an unknown function of the file /sql/library.sqCVE-2026-600007.5sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attemptCVE-2026-600016.5sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.CVE-2026-600029.4ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only CVE-2026-600049.8Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.CVE-2026-600058.2NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captur
CVE-2026-59993: Medium severity, CVSS 6.5 | Vulnix