Is CVE-2026-59993 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59993 being exploited in the wild.

How severe is CVE-2026-59993?

Medium severity, with a CVSS score of 6.5, published 30 October 2026.

Which products and versions are affected?

H2o Picotls through commit 44bc503.

Is there a fix for CVE-2026-59993?

Yes: fixed in commit a06ca41. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-59993 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-59993?

Check whether you run H2o Picotls at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59993: Picotls null pointer dereference in TLS client handshake

CVE-2026-59993 · Severity: medium · CVSS 6.5 · Published 2026-10-30

Picotls is a TLS protocol library used to secure network communications. A flaw in how the library handles TLS handshakes on the client side allows a malicious server to send specially crafted messages that crash the client application, causing a denial of service. This could affect any service or application relying on Picotls for secure connections.

Vendors: H2o.

Quick answers

Is CVE-2026-59993 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59993 being exploited in the wild.
How severe is CVE-2026-59993?: Medium severity, with a CVSS score of 6.5, published 30 October 2026.
Which products and versions are affected?: H2o Picotls through commit 44bc503.
Is there a fix for CVE-2026-59993?: Yes: fixed in commit a06ca41. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59993 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-59993?: Check whether you run H2o Picotls at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: commit a06ca41

Technical details

A null pointer dereference occurs when a TLS client receives a HelloRetryRequest followed by a spoofed Hello message due to insufficient validation of the second Hello message. The vulnerability is triggered during client-side TLS handshake processing when a peer sends a second HelloRetryRequest or a Hello message with a cipher suite that contradicts the previously established choice. The fix (commit a06ca41) adds proper rejection of duplicate HelloRetryRequest messages and validation of cipher suite consistency.

Affected products

h2o Picotls through commit 44bc503

Timeline

2026-10-30: disclosed: CVE-2026-59993 published
2026-06-29: patched: Fix merged in commit a06ca41

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.