Every CVE Search/ Get API key

CVE-2026-70367

Stunnel: ssrf bypass in stunnel socks proxy via ipv4-mapped ipv6 loopback and unspecified addresses allows access to loopback-only services

5.4 MediumFix available

A Server-Side Request Forgery (SSRF) bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses (e.g., “::ffff:127.0.0.1”) or unspecified addresses ("0.0.0.0", "::"), enabling access to loopback-only services on the "stunnel" host that should not be network-reachable.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.22%Up 0.1 points since Aug 5, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.4

Stunnel: ssrf bypass in stunnel socks proxy via ipv4-mapped ipv6 loopback and unspecified addresses allows access to loopback-only services

A Server-Side Request Forgery (SSRF) bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses (e.g., “::ffff:127.0.0.1”) or unspecified addresses ("0.0.0.0", "::"), enabling access to loopback-only services on the "stunnel" host that should not be network-reachable.

Record
CVE-2026-70367
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-918
Updated
2026-11-05
EUVDEUVD-2026-52687 5.4

A Server-Side Request Forgery (SSRF) bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses (e.g., “::ffff:127.0.0.1”) or unspecified addresses ("0.0.0.0", "::"), enabling access to loopback-only services on the "stunnel" host that should not be network-reachable.

Record
EUVD-2026-52687
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-06
GitHub AdvisoriesGHSA-2x69-8qrg-27gr 5.4

A Server-Side Request Forgery (SSRF) bypass vulnerability exists in “stunnel” 5.79 and lower when...

A Server-Side Request Forgery (SSRF) bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses (e.g., “::ffff:127.0.0.1”) or unspecified addresses ("0.0.0.0", "::"), enabling access to loopback-only services on the "stunnel" host that should not be network-reachable.

Record
GHSA-2x69-8qrg-27gr
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-918
Updated
2026-11-02
NVD 5.4

A Server-Side Request Forgery (SSRF) bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses (e.g., “::ffff:127.0.0.1”) or unspecified addresses ("0.0.0.0", "::"), enabling access to loopback-only services on the "stunnel" host that should not be network-reachable.

Record
CVE-2026-70367
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-918
Updated
2026-11-06
OSVALPINE-CVE-2026-70367 5.4

A Server-Side Request Forgery (SSRF) bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses (e.g., “::ffff:127.0.0.1”) or unspecified addresses ("0.0.0.0", "::"), enabling access to loopback-only services on the "stunnel" host that should not be network-reachable.

Record
ALPINE-CVE-2026-70367
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-03
OSV 5.4

Stunnel: ssrf bypass in stunnel socks proxy via ipv4-mapped ipv6 loopback and unspecified addresses allows access to loopback-only services

A Server-Side Request Forgery (SSRF) bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses (e.g., “::ffff:127.0.0.1”) or unspecified addresses ("0.0.0.0", "::"), enabling access to loopback-only services on the "stunnel" host that should not be network-reachable.

Record
CVE-2026-70367
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-918
Updated
2026-11-07
Show 7 moreShow less
OSVDEBIAN-CVE-2026-70367 5.4

A Server-Side Request Forgery (SSRF) bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses (e.g., “::ffff:127.0.0.1”) or unspecified addresses ("0.0.0.0", "::"), enabling access to loopback-only services on the "stunnel" host that should not be network-reachable.

Record
DEBIAN-CVE-2026-70367
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVAZL-94577 No score

CVE-2026-70367 affecting package stunnel 5.74-1

A Server-Side Request Forgery (SSRF) bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses (e.g., “::ffff:127.0.0.1”) or unspecified addresses ("0.0.0.0", "::"), enabling access to loopback-only services on the "stunnel" host that should not be network-reachable.

Record
AZL-94577
Updated
2026-11-05
OSVMGASA-2026-0575 No score

Updated stunnel package fixes security vulnerabilities

Localhost-filter bypass in SOCKS server mode. (CVE-2026-70367) Out-of-bounds memory access when logging long protocol messages. (CVE-2026-70368)

Record
MGASA-2026-0575
Updated
2026-11-05
OSVopenSUSE-SU-2026:11500-1 No score

stunnel-5.80-1.1 on GA media

These are all security issues fixed in the stunnel-5.80-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11500-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22088-1 No score

Security update for stunnel

This update for stunnel fixes the following issues:

  • CVE-2026-70367: incomplete IP address filtering in SOCKS proxy mode can allow localhost restriction bypasses (bsc#1274207).
  • CVE-2026-70368: oversized log messages in logging routines can cause stack out-of-bounds reads (bsc#1274206).
Record
openSUSE-SU-2026:22088-1
Updated
2026-11-02
OSVSUSE-SU-2026:24232-1 No score

Security update for stunnel

This update for stunnel fixes the following issues:

  • CVE-2026-70367: incomplete IP address filtering in SOCKS proxy mode can allow localhost restriction bypasses (bsc#1274207).
  • CVE-2026-70368: oversized log messages in logging routines can cause stack out-of-bounds reads (bsc#1274206).
Record
SUSE-SU-2026:24232-1
Updated
2026-11-02
OSVSUSE-SU-2026:4617-1 No score

Security update for stunnel

This update for stunnel fixes the following issues:

  • CVE-2026-70367: incomplete IP address filtering in SOCKS proxy mode can allow localhost restriction bypasses (bsc#1274207).
  • CVE-2026-70368: oversized log messages in logging routines can cause stack out-of-bounds reads (bsc#1274206).
Record
SUSE-SU-2026:4617-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
stunnel
Alpine:v3.24
 before 5.82-r0
5.82-r0
stunnel
Azure Linux:3
 through 5.74-1 None known
stunnel
Debian:14
 before 3:5.80-1, plus listed versions
2:3.26-102:3.26-112:3.26-22:3.26-2.12:3.26-3
Show 15 moreShow less
2:3.26-42:3.26-52:3.26-62:3.26-72:3.26-82:3.26-92:3.26-dfsg-12:3.26-dfsg-23.10-0potato13.22-13:5.78-33:5.78-43:5.78-53:5.79-13:5.79-2
3:5.80-1
stunnel4
Debian:12
 All versions, plus listed versions
3:5.68-23:5.68-2+deb12u13:5.70-13:5.70-23:5.72-1
Show 10 moreShow less
3:5.72-23:5.72-33:5.72-43:5.73-13:5.74-13:5.74-23:5.76-13:5.77-13:5.78-13:5.78-2
 None known
stunnel4
Debian:13
 All versions, plus listed versions
3:5.74-23:5.76-13:5.77-13:5.78-13:5.78-2
 None known
stunnel
Mageia:10
From an advisory covering 2 CVEs
 before 5.80-1.mga10
5.80-1.mga10
stunnel
SUSE:Linux Enterprise Server 16.0
From an advisory covering 2 CVEs
 before 5.74-160000.3.1
5.74-160000.3.1
stunnel
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 2 CVEs
 before 5.74-160000.3.1
5.74-160000.3.1
stunnel
SUSE:Linux Enterprise Module for Server Applications 15 SP7
From an advisory covering 2 CVEs
 before 5.70-150600.3.6.1
5.70-150600.3.6.1
stunnel
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 5.80-1.1
5.80-1.1
stunnel
openSUSE:Leap 16.0
From an advisory covering 2 CVEs
 before 5.74-160000.3.1
5.74-160000.3.1

History

History
RecordedChangedSources
affectedCVE List, EUVD, NVD, OSV
affected, aliases, facts, referencesOSV
affected, aliases, referencesOSV
affected, aliases, products, published, referencesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-70367 is a medium vulnerability (CVSS 5.4) in Microsoft Stunnel, published August 4, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 13th percentile. Fixed in stunnel 5.82-r0.

References

Show 16 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open