Skip to main content

stunnel CVE-2026-70368

| EUVDEUVD-2026-52688 MEDIUM
Out-of-bounds Read (CWE-125)
2026-08-04 redhat GHSA-g6w9-m7h7-wgq9
Buffer Overflow Information Disclosure Red Hat Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Suse Red Hat
6.5
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
vuln.today AI
6.5 MEDIUM

Network-reachable, no authentication required per stunnel's role as a public proxy; impact bounded to limited integrity (null byte corner case) and availability (crash); no confirmed attacker-readable data exfiltration path.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
6.5 MEDIUM
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
Low

Lifecycle Timeline

2
Analysis Generated
Aug 04, 2026 - 14:36 vuln.today
CVE Published
Aug 04, 2026 - 13:52 nvd
MEDIUM 6.5

DescriptionCVE.org

A stack-based out-of-bounds read vulnerability exists in the "s_vlog" function of stunnel, when handling oversized log messages via "vsnprintf". A remote attacker with network access to a stunnel service can send protocol inputs that trigger a log message longer than 1024 bytes, leading to an out-of-bounds stack read and a potential crash. In certain corner cases, the same vulnerability could be used to replace a series of trailing "\n" characters with "\0".

AnalysisAI

Stack-based out-of-bounds read in stunnel's s_vlog logging function allows remote unauthenticated attackers to crash the service by sending protocol inputs that generate log messages exceeding 1024 bytes via vsnprintf. The primary impact is service disruption (availability), with a limited integrity impact in corner cases where trailing newline characters in the stack buffer can be overwritten with null bytes. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Technical ContextAI

stunnel is a widely used open-source TLS tunneling proxy that wraps non-TLS protocols in SSL/TLS. The vulnerable code path is within the s_vlog internal logging function, which uses vsnprintf to format log messages into a fixed-size stack buffer (1024 bytes). CWE-125 (Out-of-Bounds Read) describes the root cause: when the formatted log message exceeds the buffer boundary, the read operation extends past the allocated stack region. This is distinct from a write overflow - the attacker cannot directly overwrite arbitrary memory for code execution, but can trigger an abnormal read that crashes the process or, in specific stack-layout conditions, cause trailing newline (\n) characters to be replaced with null bytes (\0), potentially corrupting log output integrity. The CPE strings confirm affected scope is stunnel as packaged and distributed within Red Hat Enterprise Linux 6, 7, 8, 9, and 10.

RemediationAI

Consult the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-70368 for vendor-released patched package versions; no specific fixed version number was confirmed in the available intelligence at time of analysis. Apply available RHEL errata updates for the stunnel package via standard package management (yum/dnf). As a compensating control, restrict network-level access to stunnel service ports using firewall rules or security groups to limit the attacker surface to trusted hosts only - this does not eliminate the vulnerability but reduces exposure. Additionally, reducing stunnel log verbosity (if configurable) to minimize the likelihood of generating log messages exceeding 1024 bytes may reduce exploitability in practice, though the trade-off is reduced diagnostic visibility. Monitor https://bugzilla.redhat.com/show_bug.cgi?id=2462029 for patch status updates.

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
CVE-2026-28369 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel

CVE-2026-28368 CRITICAL
9.1 Mar 27

HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
CVE-2026-33845 CRITICAL
9.1 Apr 30

Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
CVE-2026-28367 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
CVE-2026-16526 HIGH
8.8 Jul 30

Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected

Share

CVE-2026-70368 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy