Client-side TLS Stack Vulnerability in Picotls by H2O

CVE-2026-59993

What is CVE-2026-59993?

The Picotls library, utilized for client-side TLS communication, is susceptible to a vulnerability whereby a malicious peer may issue a 'HelloRetryRequest' followed by a spoofed hello message. This exploit triggers a null-pointer dereference, disrupting the TLS handshake and potentially crashing the consuming process. This denial of service threat can halt critical operations, underscoring the urgency for affected versions to be patched. Resolution has been implemented in subsequent commits addressing the issue.

References