CVE-2026-70368

MediumCVSS 6.5

Published: 04/08/2026(UTC)Updated: 05/11/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.35%

29th percentile - higher than 29% of all known CVEs

Summary

A stack-based out-of-bounds read vulnerability exists in the "s_vlog" function of stunnel when handling oversized log messages via "vsnprintf". A remote attacker with network access to a stunnel service can send protocol inputs that trigger a log message longer than 1024 bytes, leading to an out-of-bounds stack read and a potential crash. In certain corner cases, the same vulnerability could be used to replace a series of trailing "\n" characters with "\0".

Risk Assessment

An attacker can crash the stunnel service, causing disruption to protected applications. The ability to modify log data may also affect log integrity.

Recommendation

Upgrade stunnel to the latest patched version and restrict network access to trusted clients only.

Other vulnerabilities in stunnel

CVE-2026-70367Medium
A Server-Side Request Forgery (SSRF) bypass vulnerability exists in stunnel 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses (e.g., "::ffff:127.0.0.1") or unspecified addresses ("0.0.0.0", "::"), enabling access to loopback-only services on the stunnel host that should not be network-reachable.

Original NVD description (English source)

A stack-based out-of-bounds read vulnerability exists in the "s_vlog" function of stunnel, when handling oversized log messages via "vsnprintf". A remote attacker with network access to a stunnel service can send protocol inputs that trigger a log message longer than 1024 bytes, leading to an out-of-bounds stack read and a potential crash. In certain corner cases, the same vulnerability could be used to replace a series of trailing "\n" characters with "\0".

Vulnerability data from NVD (NIST) · CISA KEV · EPSS