CVE-2026-59993

MediumCVSS 6.5

Published: 30/10/2026(UTC)Updated: 30/10/2026(UTC)Translated: 30/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

Picotls is a TLS protocol library that allows users to select different crypto backends. In affected revisions through 44bc503, when picotls is used as a client-side TLS stack, a peer can send a HelloRetryRequest followed by a spoofed Hello message that causes a null-pointer dereference. This can terminate the consuming process, including a process performing other work, resulting in denial of service. This issue is fixed in commit a06ca41.

Risk Assessment

A malicious or compromised TLS server can crash a client process using picotls, leading to denial of service. This affects applications using picotls as a client-side TLS stack.

Recommendation

Update picotls to a version containing commit a06ca41. Until updated, consider limiting trust in TLS servers or implementing process supervision mechanisms.

Other vulnerabilities in Picotls

CVE-2026-45271Medium
Picotls is a TLS protocol library that allows users to select different crypto backends. Prior to commit c14231d801407640bc42c2dcf92783409ea6a7c7, the ASN.1 validator recursively descends into constructed ASN.1 elements without enforcing a maximum nesting depth. If an application loads an attacker-supplied private-key file through ptls_minicrypto_load_private_key(), or otherwise calls the public ASN.1 validation API on untrusted DER, a crafted deeply nested ASN.1 structure can exhaust the process stack and crash the application.

Original NVD description (English source)

Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. In affected revisions through 44bc503, when picotls is used as a `client-side TLS stack`, a peer can send a `HelloRetryRequest` followed by a `spoofed Hello message` that causes a null-pointer dereference. This can terminate the consuming process, including a process performing other work, resulting in denial of service. This issue is fixed in commit a06ca41.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS