Threats Tagged 'cve-2026-70368'

CVE-2026-70368 is a medium severity stack-based out-of-bounds read vulnerability in the s_vlog function of stunnel, affecting versions 5.79 and lower. It occurs when handling oversized log messages longer than 1024 bytes, potentially causing a crash or denial-of-service. The vulnerability can be triggered remotely by an unauthenticated attacker with network access to the stunnel service, particularly impacting server-side IMAP protocol negotiation. While causing a crash is straightforward, achieving reliable integrity impact or code execution is considered very difficult and likely impractical. Mitigation involves restricting access to stunnel services to trusted networks and avoiding exposure to untrusted clients. No official patch or fix is currently confirmed by Red Hat.