CVE-2026-70367

MediumCVSS 5.4

Published: 04/08/2026(UTC)Updated: 05/11/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

13th percentile - higher than 13% of all known CVEs

Summary

A Server-Side Request Forgery (SSRF) bypass vulnerability exists in stunnel 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses (e.g., "::ffff:127.0.0.1") or unspecified addresses ("0.0.0.0", "::"), enabling access to loopback-only services on the stunnel host that should not be network-reachable.

Risk Assessment

An attacker can access internal services that should be unreachable from outside, potentially leading to security breaches and data exposure.

Recommendation

Upgrade stunnel to a patched version and carefully configure access rules in SOCKS mode.

Other vulnerabilities in stunnel

CVE-2026-70368Medium
A stack-based out-of-bounds read vulnerability exists in the "s_vlog" function of stunnel when handling oversized log messages via "vsnprintf". A remote attacker with network access to a stunnel service can send protocol inputs that trigger a log message longer than 1024 bytes, leading to an out-of-bounds stack read and a potential crash. In certain corner cases, the same vulnerability could be used to replace a series of trailing "\n" characters with "\0".

Original NVD description (English source)

A Server-Side Request Forgery (SSRF) bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses (e.g., “::ffff:127.0.0.1”) or unspecified addresses ("0.0.0.0", "::"), enabling access to loopback-only services on the "stunnel" host that should not be network-reachable.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS