Threats Tagged 'cve-2026-70368'

A Server-Side Request Forgery (SSRF) bypass vulnerability exists in stunnel versions 5.79 and earlier when configured with the non-default 'protocol = socks' setting. This flaw allows an attacker who can reach the SOCKS proxy to bypass localhost restrictions by using IPv4-mapped IPv6 or unspecified addresses, potentially accessing services bound to the local interface that should not be network-accessible. Exploitation depends on the presence and security of such local services. The vulnerability has a medium severity rating.

A stack-based out-of-bounds read vulnerability exists in the "s_vlog" function of stunnel, when handling oversized log messages via "vsnprintf". A remote attacker with network access to a stunnel service can send protocol inputs that trigger a log message longer than 1024 bytes, leading to an out-of-bounds stack read and a potential crash. In certain corner cases, the same vulnerability could be used to replace a series of trailing "\n" characters with "\0".