The vulnerability exists in stunnel 5.79 and earlier when configured with the non-default setting "protocol = socks". An attacker able to reach the SOCKS proxy can send requests that bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses (e.g., ::ffff:127.0.0.1) or unspecified addresses (0.0.0.0, ::). This enables access to services bound to the local interface of the stunnel host that should not be reachable over the network. The SOCKS proxy is a general-purpose network access facility and should be deployed with strict firewall and client authorization controls. The vulnerability does not affect default configurations without SOCKS proxy enabled. Red Hat's advisory emphasizes that exploitation depends on the security of local services and recommends restricting access to the SOCKS listener or disabling SOCKS proxying if not needed.

This vulnerability allows an attacker with network access to the stunnel SOCKS proxy to bypass localhost access restrictions and potentially interact with local services that are not intended to be exposed externally. The impact includes limited confidentiality and integrity risks, as attackers might read application data or execute unauthorized commands via local services. There is no impact on availability. Exploitation requires the SOCKS proxy mode to be enabled and accessible to the attacker.

If SOCKS proxying is not required, disable the "protocol = socks" setting in stunnel. If SOCKS proxying is necessary, restrict access to the SOCKS listener by binding it to a trusted management network or localhost, and enforce client authentication or network ACLs. Running stunnel in isolated containers or network namespaces without other services bound to localhost, or applying firewall rules to restrict outgoing connections from stunnel to localhost, can further mitigate the risk. No official patch or fix is currently confirmed; check the vendor advisory for updates.