stunnel CVE-2026-70368

Network access to a stunnel service port is the primary prerequisite - stunnel must be reachable by the attacker, which is its normal deployment posture as a network proxy. The vulnerability activates when an attacker can cause stunnel to generate an internal log message exceeding 1024 bytes via the s_vlog/vsnprintf code path; this is triggered by sufficiently crafted protocol inputs on any proxied connection, with no authentication required (CVSS PR:N). The corner-case integrity impact (null byte replacement of trailing newlines) additionally requires a specific stack memory layout at time of exploitation, making it non-deterministic and difficult to reliably reproduce. Exploitation is limited to scenarios where the stunnel process is reachable over the network; if stunnel is bound to localhost or behind strict firewall rules, remote attack surface is eliminated. RHEL 6 systems are end-of-life and unlikely to receive patches, increasing risk on legacy deployments.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) scores 6.5 Medium, reflecting network-reachable, unauthenticated exploitation with limited impact. The attack complexity is low - no special conditions beyond crafting sufficiently verbose protocol inputs - which is a meaningful escalation factor. However, the bounded impact (no confidentiality loss, limited integrity and availability) constrains real-world severity. EPSS data was not provided in the source intelligence, so exploitation probability cannot be quantified from available signals. The vulnerability is not listed in CISA KEV, and no public proof-of-concept was identified, suggesting opportunistic or widespread automated exploitation is not currently occurring. The 'Information Disclosure' tag in the source data hints at possible stack memory exposure via the out-of-bounds read, but the CVSS C:N assignment indicates no confirmed attacker-accessible exfiltration path. The corner-case integrity impact (null byte injection) is unlikely to be reliably weaponized. Net assessment: this is a moderate-priority remediation - real, remotely triggerable, but not a critical emergency in the absence of active exploitation signals.

A remote attacker with network connectivity to a stunnel-protected service sends crafted protocol inputs designed to trigger verbose internal logging - for example, excessively long connection metadata, protocol banners, or error-inducing payloads - causing the s_vlog function to format a log message exceeding 1024 bytes. This triggers the out-of-bounds stack read, crashing the stunnel process and interrupting TLS tunneling for all clients routed through it. No public proof-of-concept is known at time of analysis, but the low attack complexity (AC:L, no auth) means the trigger condition is straightforward to discover through fuzzing.