CVE-2026-59993: picotls: HelloRetryRequest null deref crashes TLS clients

MEDIUM

Published October 30, 2026

CISO Take

Picotls, a TLS library used as a client-side stack, has a null-pointer dereference (CWE-476). A malicious or compromised server can send a HelloRetryRequest followed by a spoofed Hello message and crash the process that embeds the library. The impact is availability only, with no confidentiality or integrity loss. CVSS is 6.5 (medium), the CVE is not in CISA KEV, no public exploit or Nuclei template exists, and no EPSS data is available yet. Exposure is limited by 27 downstream dependents, but the package has 25 other CVEs and an OpenSSF Scorecard of 5.7/10, so its security hygiene is mediocre. Update to a build that includes commit a06ca41 (anything after 44bc503) and check whether AI/ML services that make outbound TLS connections through picotls (for example QUIC or HTTP/3 clients) would drop all in-flight work if the process died.

Sources:NVDGitHub AdvisoryOpenSSFATLAS

What is the risk?

Medium. The attack is network-based with low complexity and no privileges, but the CVSS vector sets user interaction to required, meaning the client must connect to an attacker-controlled or intercepted server. Impact is limited to availability (A:H), and the whole consuming process can be terminated. No active exploitation, KEV listing, public exploit or scanner template is known. Risk rises for long-running AI services that make outbound TLS connections to untrusted endpoints and share a process with other workloads.

How does the attack unfold?

Initial Access

Attacker controls or impersonates a TLS server that a picotls-based client connects to.

AML.T0049

Exploitation

Server sends a HelloRetryRequest followed by a spoofed Hello message, triggering a null-pointer dereference (CWE-476) in the client.

Impact

The consuming process terminates, causing denial of service for the AI workload and any co-hosted tasks.

AML.T0029

Initial Access

Attacker controls or impersonates a TLS server that a picotls-based client connects to.

AML.T0049

Exploitation

Server sends a HelloRetryRequest followed by a spoofed Hello message, triggering a null-pointer dereference (CWE-476) in the client.

Impact

The consuming process terminates, causing denial of service for the AI workload and any co-hosted tasks.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
H2O	pip	—	No patch
7.5KOpenSSF 5.727 dependentsPushed 9d ago8% patched~0d to patchFull package profile →

Do you use H2O? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 16% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRNone

UIRequired

SUnchanged

CNone

INone

AHigh

What should I do?

5 steps

Upgrade picotls to a version containing commit a06ca417a16f9126808bf5cabe6c5e6e0f16ecae (PR #608) and rebuild any statically linked dependents.
Inventory software bills of materials for picotls, including indirect inclusion via h2o, QUIC libraries or Python wheels.
Restrict outbound TLS connections to trusted, allow-listed endpoints and use egress filtering.
Run TLS-client workloads in isolated, supervised processes with automatic restart so a crash does not take down other work.
Detect by alerting on unexpected segfaults or SIGSEGV exits in processes using picotls, and by watching for unusual HelloRetryRequest patterns in network telemetry.

How is it classified?

DoSFrameworkAPIAML.T0029- Denial of AI Service

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.10.3-Suppliers

NIST AI RMF

MANAGE 2.3-Procedures to respond to and recover from unknown risks

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-59993?

Is CVE-2026-59993 actively exploited?

No confirmed active exploitation of CVE-2026-59993 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-59993?

1. Upgrade picotls to a version containing commit a06ca417a16f9126808bf5cabe6c5e6e0f16ecae (PR #608) and rebuild any statically linked dependents. 2. Inventory software bills of materials for picotls, including indirect inclusion via h2o, QUIC libraries or Python wheels. 3. Restrict outbound TLS connections to trusted, allow-listed endpoints and use egress filtering. 4. Run TLS-client workloads in isolated, supervised processes with automatic restart so a crash does not take down other work. 5. Detect by alerting on unexpected segfaults or SIGSEGV exits in processes using picotls, and by watching for unusual HelloRetryRequest patterns in network telemetry.

What systems are affected by CVE-2026-59993?

This vulnerability affects the following AI/ML architecture patterns: Model serving, Data ingestion pipelines, Agent frameworks, QUIC/HTTP3 clients.

What is the CVSS score for CVE-2026-59993?

CVE-2026-59993 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.25%.

What is the AI security impact?

Affected AI Architectures

Model servingData ingestion pipelinesAgent frameworksQUIC/HTTP3 clients

MITRE ATLAS Techniques

AML.T0029Denial of AI Service

Compliance Controls Affected

ISO 42001: A.10.3

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. In affected revisions through 44bc503, when picotls is used as a `client-side TLS stack`, a peer can send a `HelloRetryRequest` followed by a `spoofed Hello message` that causes a null-pointer dereference. This can terminate the consuming process, including a process performing other work, resulting in denial of service. This issue is fixed in commit a06ca41.

Exploitation Scenario

An attacker controls or impersonates a remote server (for example a malicious model-artifact mirror, webhook endpoint or third-party API) that an AI service connects to using a picotls-based client. When the victim client connects, the server replies with a HelloRetryRequest and then a spoofed Hello message. The client dereferences a null pointer and the process crashes. The attacker repeats this so a model-serving or data-ingestion service that shares the process stays unavailable.

Weaknesses (CWE)

CWE-476NULL Pointer Dereference

CWE-476 — NULL Pointer Dereference: The product dereferences a pointer that it expects to be valid but is NULL.

[Implementation] For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
[Requirements] Select a programming language that is not susceptible to these issues.

Source: MITRE CWE corpus.