{"id":"CVE-2026-70367","aliases":["ALPINE-CVE-2026-70367","AZL-94577","DEBIAN-CVE-2026-70367","EUVD-2026-52687","GHSA-2x69-8qrg-27gr","MGASA-2026-0575","SUSE-SU-2026:24232-1","SUSE-SU-2026:4617-1","openSUSE-SU-2026:11500-1","openSUSE-SU-2026:22088-1"],"status":"published","title":"Stunnel: ssrf bypass in stunnel socks proxy via ipv4-mapped ipv6 loopback and unspecified addresses allows access to loopback-only services","description":"A Server-Side Request Forgery (SSRF) bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses (e.g., “::ffff:127.0.0.1”) or unspecified addresses (\"0.0.0.0\", \"::\"), enabling access to loopback-only services on the \"stunnel\" host that should not be network-reachable.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00224,"percentile":0.13104,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-918"],"published":"2026-08-04T13:52:20Z","modified":"2026-11-05T23:16:57Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"stunnel","fixed_in":["5.82-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"stunnel","fixed_in":["3:5.80-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"stunnel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.82-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"stunnel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.74-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"stunnel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:5.80-1"}]}],"versions":["2:3.26-10","2:3.26-11","2:3.26-2","2:3.26-2.1","2:3.26-3","2:3.26-4","2:3.26-5","2:3.26-6","2:3.26-7","2:3.26-8","2:3.26-9","2:3.26-dfsg-1","2:3.26-dfsg-2","3.10-0potato1","3.22-1","3:5.78-3","3:5.78-4","3:5.78-5","3:5.79-1","3:5.79-2"]},{"source":"osv","ecosystem":"Debian:12","package":"stunnel4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3:5.68-2","3:5.68-2+deb12u1","3:5.70-1","3:5.70-2","3:5.72-1","3:5.72-2","3:5.72-3","3:5.72-4","3:5.73-1","3:5.74-1","3:5.74-2","3:5.76-1","3:5.77-1","3:5.78-1","3:5.78-2"]},{"source":"osv","ecosystem":"Debian:13","package":"stunnel4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3:5.74-2","3:5.76-1","3:5.77-1","3:5.78-1","3:5.78-2"]},{"source":"osv","ecosystem":"Mageia:10","package":"stunnel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.80-1.mga10"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"stunnel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.74-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"stunnel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.74-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"stunnel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.70-150600.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"stunnel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.80-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"stunnel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.74-160000.3.1"}]}],"bundled":2}],"products":[{"vendor":"microsoft","product":"stunnel"},{"vendor":"mobi-com polska sp. z o.o.","product":"stunnel"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-70367","tags":["vdb-entry","x_refsource_REDHAT","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2462083","tags":["issue-tracking","x_refsource_REDHAT","exploit","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70367","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-2x69-8qrg-27gr"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-70367","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/70xxx/CVE-2026-70367.json","tags":["advisory"]},{"url":"https://github.com/mtrojnar/stunnel","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-70367","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0575.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36183","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/472TIVLEO2YOJZVNWJR6RWFE3SX4M7P6/","tags":["web"]},{"url":"https://www.stunnel.org/CVE-2026-70367.html","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2462029","tags":["report"]},{"url":"https://www.stunnel.org/CVE-2026-70368.html","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IX766E4H5ND5VOKDYVM2E2GUCKKG6EDD/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624232-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1274206","tags":["report"]},{"url":"https://bugzilla.suse.com/1274207","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70367","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70368","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264617-1/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-70367","title":"Stunnel: ssrf bypass in stunnel socks proxy via ipv4-mapped ipv6 loopback and unspecified addresses allows access to loopback-only services","description":"A Server-Side Request Forgery (SSRF) bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses (e.g., “::ffff:127.0.0.1”) or unspecified addresses (\"0.0.0.0\", \"::\"), enabling access to loopback-only services on the \"stunnel\" host that should not be network-reachable.","status":"published","published":"2026-08-04T13:52:20.527Z","modified":"2026-11-05T22:51:54.689Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-918"],"updated_at":"2026-11-05T23:55:29.66083Z"}],"euvd":[{"id":"EUVD-2026-52687","description":"A Server-Side Request Forgery (SSRF) bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses (e.g., “::ffff:127.0.0.1”) or unspecified addresses (\"0.0.0.0\", \"::\"), enabling access to loopback-only services on the \"stunnel\" host that should not be network-reachable.","status":"published","published":"2026-08-04T13:52:20Z","modified":"2026-11-05T22:51:54Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-06T00:02:32.983223Z"}],"ghsa":[{"id":"GHSA-2x69-8qrg-27gr","title":"A Server-Side Request Forgery (SSRF) bypass vulnerability exists in “stunnel” 5.79 and lower when...","description":"A Server-Side Request Forgery (SSRF) bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses (e.g., “::ffff:127.0.0.1”) or unspecified addresses (\"0.0.0.0\", \"::\"), enabling access to loopback-only services on the \"stunnel\" host that should not be network-reachable.","status":"published","published":"2026-08-04T15:32:22Z","modified":"2026-08-04T15:32:23Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:10:04.647546Z"}],"nvd":[{"id":"CVE-2026-70367","description":"A Server-Side Request Forgery (SSRF) bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses (e.g., “::ffff:127.0.0.1”) or unspecified addresses (\"0.0.0.0\", \"::\"), enabling access to loopback-only services on the \"stunnel\" host that should not be network-reachable.","status":"published","published":"2026-08-04T14:16:32.557Z","modified":"2026-11-05T23:16:57.937Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-918"],"updated_at":"2026-11-06T01:57:39.389848Z"}],"osv":[{"id":"ALPINE-CVE-2026-70367","description":"A Server-Side Request Forgery (SSRF) bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses (e.g., “::ffff:127.0.0.1”) or unspecified addresses (\"0.0.0.0\", \"::\"), enabling access to loopback-only services on the \"stunnel\" host that should not be network-reachable.","status":"published","published":"2026-08-04T14:16:32.557Z","modified":"2026-11-03T06:33:03.909267012Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T07:15:37.282377Z"},{"id":"CVE-2026-70367","title":"Stunnel: ssrf bypass in stunnel socks proxy via ipv4-mapped ipv6 loopback and unspecified addresses allows access to loopback-only services","description":"A Server-Side Request Forgery (SSRF) bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses (e.g., “::ffff:127.0.0.1”) or unspecified addresses (\"0.0.0.0\", \"::\"), enabling access to loopback-only services on the \"stunnel\" host that should not be network-reachable.","status":"published","published":"2026-08-04T13:52:20.527Z","modified":"2026-11-07T07:06:54.182609339Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-07T03:08:09.473992Z"},{"id":"DEBIAN-CVE-2026-70367","description":"A Server-Side Request Forgery (SSRF) bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses (e.g., “::ffff:127.0.0.1”) or unspecified addresses (\"0.0.0.0\", \"::\"), enabling access to loopback-only services on the \"stunnel\" host that should not be network-reachable.","status":"published","published":"2026-08-04T14:16:32.557Z","modified":"2026-10-05T01:00:08.022505668Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:46:02.094661Z"},{"id":"AZL-94577","title":"CVE-2026-70367 affecting package stunnel 5.74-1","description":"A Server-Side Request Forgery (SSRF) bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses (e.g., “::ffff:127.0.0.1”) or unspecified addresses (\"0.0.0.0\", \"::\"), enabling access to loopback-only services on the \"stunnel\" host that should not be network-reachable.","status":"published","published":"2026-08-04T14:16:32Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.077208Z"},{"id":"MGASA-2026-0575","title":"Updated stunnel package fixes security vulnerabilities","description":"Localhost-filter bypass in SOCKS server mode. (CVE-2026-70367)\nOut-of-bounds memory access when logging long protocol messages.\n(CVE-2026-70368)\n","status":"published","published":"2026-11-05T05:11:54Z","modified":"2026-11-05T05:15:03.017191528Z","updated_at":"2026-11-05T07:10:31.343344Z"},{"id":"openSUSE-SU-2026:11500-1","title":"stunnel-5.80-1.1 on GA media","description":"These are all security issues fixed in the stunnel-5.80-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-11T00:00:00Z","modified":"2026-08-12T10:45:07.963443196Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:22088-1","title":"Security update for stunnel","description":"This update for stunnel fixes the following issues:\n\n- CVE-2026-70367: incomplete IP address filtering in SOCKS proxy mode can allow localhost restriction bypasses\n  (bsc#1274207).\n- CVE-2026-70368: oversized log messages in logging routines can cause stack out-of-bounds reads (bsc#1274206).\n","status":"published","published":"2026-10-12T08:44:51Z","modified":"2026-10-19T17:23:13.535165945Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:24232-1","title":"Security update for stunnel","description":"This update for stunnel fixes the following issues:\n\n- CVE-2026-70367: incomplete IP address filtering in SOCKS proxy mode can allow localhost restriction bypasses\n  (bsc#1274207).\n- CVE-2026-70368: oversized log messages in logging routines can cause stack out-of-bounds reads (bsc#1274206).\n","status":"published","published":"2026-10-12T08:36:43Z","modified":"2026-10-21T17:23:11.153668693Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:4617-1","title":"Security update for stunnel","description":"This update for stunnel fixes the following issues:\n\n- CVE-2026-70367: incomplete IP address filtering in SOCKS proxy mode can allow localhost restriction bypasses\n  (bsc#1274207).\n- CVE-2026-70368: oversized log messages in logging routines can cause stack out-of-bounds reads (bsc#1274206).\n","status":"published","published":"2026-10-12T07:21:51Z","modified":"2026-10-13T10:30:04.877046259Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}