CVE-2026-70368— Stunnel: stack-based out-of-bounds read/write in stunnel s_vlog via oversized log message

Quick assessment

Affected

Mobi-Com Polska Sp. z o.o. stunnel

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Stunnel是Stunnel组织开源的一个提供SSL/TLS加密隧道的代理软件。 stunnel存在缓冲区错误漏洞，该漏洞源于s_vlog函数通过vsnprintf处理超长日志消息时存在基于栈的越界读取，可能导致远程攻击者触发崩溃。

CVSS 6.5 · Medium EPSS 0.35% · P29 Updated Nov 06, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 6

Vendor	Product	Version Range	Status
Mobi-Com Polska Sp. z o.o.	stunnel	`5.68< 5.80`	affected
Red Hat	Red Hat Enterprise Linux 10	`any`	affected
Red Hat	Red Hat Enterprise Linux 6	`any`	unaffected
Red Hat	Red Hat Enterprise Linux 7	`any`	unaffected
Red Hat	Red Hat Enterprise Linux 8	`any`	affected
Red Hat	Red Hat Enterprise Linux 9	`any`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-70368

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Stunnel: stack-based out-of-bounds read/write in stunnel s_vlog via oversized log message

Source: CVE Program / CVE List V5

Vulnerability Description

A stack-based out-of-bounds read vulnerability exists in the "s_vlog" function of stunnel, when handling oversized log messages via "vsnprintf". A remote attacker with network access to a stunnel service can send protocol inputs that trigger a log message longer than 1024 bytes, leading to an out-of-bounds stack read and a potential crash. In certain corner cases, the same vulnerability could be used to replace a series of trailing "\n" characters with "\0".

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

跨界内存读

Source: CVE Program / CVE List V5

Vulnerability Title

stunnel 缓冲区错误漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE
Mobi-Com Polska Sp. z o.o.	stunnel	5.68 ~ 5.80	-
Red Hat	Red Hat Enterprise Linux 10	-	`cpe:/a:redhat:enterprise_linux:10`
Red Hat	Red Hat Enterprise Linux 6	-	`cpe:/o:redhat:rhel_els:6`
Red Hat	Red Hat Enterprise Linux 7	-	`cpe:/o:redhat:rhel_els:7`
Red Hat	Red Hat Enterprise Linux 8	-	`cpe:/a:redhat:enterprise_linux:8`
Red Hat	Red Hat Enterprise Linux 9	-	`cpe:/a:redhat:enterprise_linux:9`