CVE-2026-59993

Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. In affected revisions through 44bc503, when picotls is used as a `client-side TLS stack`, a peer can send a `HelloRetryRequest` followed by a `spoofed Hello message` that causes a null-pointer dereference. This can terminate the consuming process, including a process performing other work, resulting in denial of service. This issue is fixed in commit a06ca41.

• CWE-476

• https://github.com/h2o/picotls/commit/a06ca417a16f9126808bf5cabe6c5e6e0f16ecae
• https://github.com/h2o/picotls/pull/608
• https://github.com/h2o/picotls/security/advisories/GHSA-2xcv-h2pg-m99c

Published

Oct 30, 2026

Last Modified

Oct 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-59985OpenEXR is the reference implementation and specification fo…5.5
• CVE-2026-59989Phalcon is a high-performance, full-stack PHP framework. In …9.2
• CVE-2026-5999A vulnerability has been found in JeecgBoot up to 3.9.1. Thi…6.3
• CVE-2026-59990Jawn is an open source JSON parser. Prior to 1.7.0, Jawn par…7.5
• CVE-2026-59991psd-tools is a Python package for working with Adobe Photosh…7.5
• CVE-2026-59992Tina is a headless content management system. Prior to next-…5.4
• CVE-2026-59994EspoCRM is an open source customer relationship management a…4.3
• CVE-2026-59995sftp in OpenSSH before 10.4 does not properly constrain the …5.4
• CVE-2026-59996scp in OpenSSH before 10.4 may place a file in the parent di…5.4
• CVE-2026-59997internal-sftp in sshd in OpenSSH before 10.4 recognizes only…5.4
• CVE-2026-59998sshd in OpenSSH before 10.4 has an undocumented security-rel…6.5
• CVE-2026-59999In sshd in OpenSSH before 10.4, DisableForwarding=yes was su…7.5