CVE-2026-70368: Stunnel: stack-based out-of-bounds read/write in stunnel s_vlog via oversized log message

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-04 · updated 2026-08-06
Weakness: CWE-125

Description

A stack-based out-of-bounds read vulnerability exists in the "s_vlog" function of stunnel, when handling oversized log messages via "vsnprintf". A remote attacker with network access to a stunnel service can send protocol inputs that trigger a log message longer than 1024 bytes, leading to an out-of-bounds stack read and a potential crash. In certain corner cases, the same vulnerability could be used to replace a series of trailing "\n" characters with "\0".

Affected products

Mobi-Com Polska Sp. z o.o. stunnel: from 5.68 before 5.80 — fixed in 5.80
Red Hat Enterprise Linux 10: all versions
Red Hat Enterprise Linux 8: all versions
Red Hat Enterprise Linux 9: all versions

How to fix

Upgrade to a fixed version: Mobi-Com Polska Sp. z o.o. stunnel 5.80. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-70368 or the next vulnerability affects your stack