CVE-2023-25076: SNIProxy wildcard backend host buffer overflow allows code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication, and code execution impact, plus high EPSS and a public exploit reference, warrant critical handling despite no KEV listing.

What it is

SNIProxy 0.6.0-2 and the master branch mishandle wildcard backend hosts, producing a classic buffer overflow (CWE-120) when processing a crafted HTTP or TLS packet. The flaw is remotely reachable without authentication and can lead to arbitrary code execution, making it a serious risk for any exposed SNIProxy instance.

Impact

An unauthenticated remote attacker can corrupt memory and potentially execute arbitrary code with the privileges of the SNIProxy process, gaining full control of the affected host or at least causing a crash.

Attack surface

Reached over the network by sending a specially crafted HTTP or TLS packet to the SNIProxy listener; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Not listed in CISA KEV, but EPSS is high (0.65753, 99.2nd percentile) and the Talos advisory is tagged Exploit, indicating public exploit detail exists though active exploitation is not confirmed.

What to do

• Apply the upstream patch commit f8d9a433fe22ab2fa15c00179048ab02ae23d583 or upgrade to a fixed SNIProxy release.
• Apply the Debian security updates DSA-5413 and the LTS announcement for packaged deployments.
• Restrict network exposure of SNIProxy listeners to trusted sources and place them behind a filtering proxy or firewall where possible.
• Review Talos TALOS-2023-1731 mitigation guidance and avoid wildcard backend host configurations until patched.

Detection

• Monitor SNIProxy process crashes or restarts that coincide with inbound HTTP/TLS traffic.
• Inspect proxy and network logs for malformed or unusually long SNI/host values targeting wildcard backend configurations.
• Watch for unexpected child processes or outbound connections originating from the SNIProxy host.
• Alert on repeated connection attempts to SNIProxy ports from single sources that precede a crash.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.