CVE-2026-70367
- Source
- https://cve.org/CVERecord?id=CVE-2026-70367
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-70367.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-70367
- Downstream
- Published
- 2026-08-04T13:52:20.527Z
- Modified
- 2026-08-10T08:05:09.536018Z
- Severity
-
- 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
- Summary
- Stunnel: ssrf bypass in stunnel socks proxy via ipv4-mapped ipv6 loopback and unspecified addresses allows access to loopback-only services
- Details
-
A Server-Side Request Forgery (SSRF) bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses (e.g., “::ffff:127.0.0.1”) or unspecified addresses ("0.0.0.0", "::"), enabling access to loopback-only services on the "stunnel" host that should not be network-reachable.
- Database specific
{ "cna_assigner": "redhat", "cwe_ids": [ "CWE-918" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/70xxx/CVE-2026-70367.json" }- References
-
- https://access.redhat.com/downloads/content/package-browser/
- https://access.redhat.com/security/cve/CVE-2026-70367
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/70xxx/CVE-2026-70367.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-70367
- https://bugzilla.redhat.com/show_bug.cgi?id=2462083
- https://github.com/mtrojnar/stunnel
Affected packages
Git / github.com/mtrojnar/stunnel
Affected versions
stunnel-5.*
stunnel-5.25
stunnel-5.26
stunnel-5.27
stunnel-5.28
stunnel-5.29
stunnel-5.30
stunnel-5.31
stunnel-5.33
stunnel-5.34
stunnel-5.35
stunnel-5.36
stunnel-5.37
stunnel-5.38
stunnel-5.39
stunnel-5.40
stunnel-5.41
stunnel-5.42
stunnel-5.43
stunnel-5.44
stunnel-5.45
stunnel-5.46
stunnel-5.47
stunnel-5.48
stunnel-5.49
stunnel-5.50
stunnel-5.51
stunnel-5.52
stunnel-5.53
stunnel-5.54
stunnel-5.55
stunnel-5.56
stunnel-5.57
stunnel-5.58
stunnel-5.59
stunnel-5.60
stunnel-5.61
stunnel-5.62
stunnel-5.63
stunnel-5.64
stunnel-5.65
stunnel-5.66
stunnel-5.67
stunnel-5.68
stunnel-5.69
stunnel-5.70
stunnel-5.71
stunnel-5.72
stunnel-5.73
stunnel-5.74
stunnel-5.75
stunnel-5.76
stunnel-5.77
stunnel-5.78
stunnel-5.79
Database specific
vanir_signatures_modified
"2026-08-10T08:05:09Z"
vanir_signatures
[
{
"target": {
"function": "s_vlog",
"file": "src/log.c"
},
"digest": {
"length": 1453.0,
"function_hash": "53216965347798639662756561830214041258"
},
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2026-70367-2f7bd336",
"source": "https://github.com/mtrojnar/stunnel/commit/62ab5ccf33485b81bc4eaf0c76fd5558d2458e08"
},
{
"target": {
"file": "src/ui_win_gui.c"
},
"digest": {
"line_hashes": [
"300838760740498916727528886639410290551",
"210841920785737346975577575429436250958",
"78656332006269252407677460046937969392",
"137016240559842971849956920891464825845"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2026-70367-3c5f22e5",
"source": "https://github.com/mtrojnar/stunnel/commit/62ab5ccf33485b81bc4eaf0c76fd5558d2458e08"
},
{
"target": {
"function": "init_crl",
"file": "src/verify.c"
},
"digest": {
"length": 431.0,
"function_hash": "117107876511809418361048565180966924289"
},
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2026-70367-467b2433",
"source": "https://github.com/mtrojnar/stunnel/commit/62ab5ccf33485b81bc4eaf0c76fd5558d2458e08"
},
{
"target": {
"file": "src/options.c"
},
"digest": {
"line_hashes": [
"3595484820298666199007738651285703744",
"61243559595004869557226526021126009918",
"289281473792286056188061846290048890628"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2026-70367-4cf0aa94",
"source": "https://github.com/mtrojnar/stunnel/commit/62ab5ccf33485b81bc4eaf0c76fd5558d2458e08"
},
{
"target": {
"file": "src/verify.c"
},
"digest": {
"line_hashes": [
"305208808442846169172785283557932203609",
"49897403995536265552834653516750509732",
"81365332215018368336627963622394636500",
"288054664844844721837181395654061296907",
"202119073354156763254595906367678325539",
"217500080667019106098429745038189413628",
"48596394056935550994801752276856257256",
"288209864533071369295542124727426463126"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2026-70367-53c9cf77",
"source": "https://github.com/mtrojnar/stunnel/commit/62ab5ccf33485b81bc4eaf0c76fd5558d2458e08"
},
{
"target": {
"function": "parse_service_option",
"file": "src/options.c"
},
"digest": {
"length": 64629.0,
"function_hash": "64879305346802684165508371114421348087"
},
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2026-70367-583e09b8",
"source": "https://github.com/mtrojnar/stunnel/commit/62ab5ccf33485b81bc4eaf0c76fd5558d2458e08"
},
{
"target": {
"file": "src/log.c"
},
"digest": {
"line_hashes": [
"106561923383099257648051938344888754867",
"40512398613990358635255278301946200882",
"165577672410587669060666359750527418686",
"195851150840538001280551410431183071888",
"217763584644850009221685104870594782244",
"300359778945180731035287253679303480260",
"4118837184956830265451429077069028117",
"222898659805546514570924520518982303812",
"179378134336620383423818866738297090080",
"115702188164251621936582106853986577697",
"247005539948712601793246124994688094273",
"276639754083654034991848216786181349603",
"102481446655614188069138356003102772262",
"54606571580269571786719277356596128162",
"13634748769862555093170026253438904231",
"153049223675756150089892250844059221293",
"48072012794901446343167121075361580589",
"129486167377240480722816258758538835408",
"46964258922570412732623373457147478781"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2026-70367-778fb6fd",
"source": "https://github.com/mtrojnar/stunnel/commit/62ab5ccf33485b81bc4eaf0c76fd5558d2458e08"
},
{
"target": {
"function": "dtls_listen",
"file": "src/network.c"
},
"digest": {
"length": 3006.0,
"function_hash": "63685943870807076004836130448047440180"
},
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2026-70367-7addb8aa",
"source": "https://github.com/mtrojnar/stunnel/commit/62ab5ccf33485b81bc4eaf0c76fd5558d2458e08"
},
{
"target": {
"file": "src/stunnel.c"
},
"digest": {
"line_hashes": [
"224476903368059129088253117635793033161",
"95676811420737608448105044452961885035",
"277449470398892913196999218081764900834",
"61683903780567750178674089514894792374"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2026-70367-7ca45736",
"source": "https://github.com/mtrojnar/stunnel/commit/62ab5ccf33485b81bc4eaf0c76fd5558d2458e08"
},
{
"target": {
"file": "src/network.c"
},
"digest": {
"line_hashes": [
"282904634021523432099740069901111592057",
"301891425985895554850074648233743015876",
"116889016659417332762474641099410381009",
"328329031847488551026822447059103287852",
"231595044359278575038254100062261827606",
"84849263762338542932081593428556417195",
"133233553870381822770162452552651888557",
"208701068504914444961967037103657562370",
"253814635602608279655953629650241781281",
"242219530177325359126456546701269306246",
"195358324637367735063590313513259704278",
"151324662007513787101659524867109510056",
"21509194815764525221479874148011751041",
"152091286174935672228041789135906686352"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2026-70367-88b4611b",
"source": "https://github.com/mtrojnar/stunnel/commit/62ab5ccf33485b81bc4eaf0c76fd5558d2458e08"
},
{
"target": {
"file": "src/ctx.c"
},
"digest": {
"line_hashes": [
"56813137796924886102757803902908937252",
"266925903033147225687032691342129448383",
"38855167165941264799487086074552108033",
"118461857011106602919833769184812660885",
"237556975517355647914539436981268352409",
"137957657660332967620391276657126710189",
"270139362318323238943685376639178912282",
"328782703006270182165483712370838731348",
"337325127734518094582748941087059902830",
"73086603380512312944094213450753145741",
"293870156063566655736501111771082232338",
"105357671582551525773010310514541063615",
"27632273418513752965969045762132970528",
"224295401182790266451606196355313178470",
"17195565764813013532526394098636540287",
"178119157922127323354068875760225028910",
"233145900419718712504006039194051865303",
"11485458874039607521360520809317106878",
"229290700631675946732833917514016047490",
"201784219638114518727892522386745817848",
"71601270029996363610891228675104975081",
"95596227634321196271634296830082853867",
"32040988405666457312490667641748772779",
"52962655628619720339408012467865604387",
"16372303524408099661807943234443067219",
"223459523862732234087957583510172540215",
"245207877947611695120067873272294634813",
"89765094359128082782236064786726465725",
"210711390711214150506577598680496062130",
"169298879273301068425682026976510020185",
"320484373244194393617863195142333906256",
"145563497409814980921410631065142279629",
"299898962488927685049163193277802049738",
"58452355391722944920121149315408531905",
"62420137830295422660321628071470470279",
"202925201278314957611232686911129350832",
"162140369757971352240665492418693732183",
"109780362930743688055665950617925110652",
"208036688712268303393194306728397626660",
"306805989803594658822889198106397158976"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2026-70367-93322907",
"source": "https://github.com/mtrojnar/stunnel/commit/62ab5ccf33485b81bc4eaf0c76fd5558d2458e08"
},
{
"target": {
"function": "get_dh2048",
"file": "src/dhparam.c"
},
"digest": {
"length": 2246.0,
"function_hash": "159635595401001736683120108524735221206"
},
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2026-70367-ad2c9520",
"source": "https://github.com/mtrojnar/stunnel/commit/62ab5ccf33485b81bc4eaf0c76fd5558d2458e08"
},
{
"target": {
"file": "src/prototypes.h"
},
"digest": {
"line_hashes": [
"126508024106151707137244321232375954370",
"103792203274801738617698431901013391667",
"205080902813143253882568403547051000266",
"158113002667331642090488681807851900916",
"339448637209400088044227204305470811356",
"299407735322427970221451600072749697264",
"312969468237109667340906542786394972148",
"259447220107295144595622188341804279378"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2026-70367-b15846a9",
"source": "https://github.com/mtrojnar/stunnel/commit/62ab5ccf33485b81bc4eaf0c76fd5558d2458e08"
},
{
"target": {
"function": "start_accepted_client",
"file": "src/stunnel.c"
},
"digest": {
"length": 483.0,
"function_hash": "277313936857424386489486146750375268756"
},
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2026-70367-b1e7a216",
"source": "https://github.com/mtrojnar/stunnel/commit/62ab5ccf33485b81bc4eaf0c76fd5558d2458e08"
},
{
"target": {
"file": "src/protocol.c"
},
"digest": {
"line_hashes": [
"106817755265728803005935388339126119101",
"191203130864686603109179986776802837471",
"23483154084798263637854670020486929955",
"26261821084995321877017721726194006935",
"26690366476211614493602718003019870020",
"145512478266416937696220760146389236560",
"59745917587955298150955156790005907032",
"315569497074856475405720030538284059933",
"288827174947277749080233742815586837825",
"302771814393177114445771178313663245296",
"84556893231601023227410800181027615793",
"6837809024966058093295258928087524963",
"89748228357177699831669580004615189535",
"194655591278560290627629273451516172854",
"230257226135366131765746008050784318119",
"102081830382464546002719620235960180174",
"33774881589452957833536935891942122691",
"150754429060852009260668705226030332378",
"79859354937262399672176403952185637782",
"41469861174330198069807527190883834876",
"70085759035616938260085533513307762016",
"176353860690808089908279172095593885116",
"96905979811653118754864244456233555785",
"301131629925296514391620569818016518072",
"227892939700472813998570146468359513309",
"249507442198257331046367480906270942798",
"274889401759826922160645496488153282482",
"288894015835770128914401200927971954392",
"299733773104211564213618081544873184671",
"276851970441693582769722256725615258461",
"136691965164946861142620531856014077432",
"148186843770949526710272346758866592127",
"90542835371171410037944064512202692672",
"4904313314805110413823257274835616631",
"36699791929072691383014428303857180029",
"30387412032999248764368636005186337318",
"163702922035100501485827117107240375250",
"137410187597478550555994064767022181609",
"134595669296718233732548213613381204523",
"253979956317251108323289177360665826655",
"329754285052463181516576688221802931382",
"259778893534354674507957185928591844059",
"260609435002562614439883394297651694651",
"75863566715294305171220883375504875997",
"133059347511697810022433346830096200998",
"253425426310681997063385137556220528538",
"314422146190205774076587975991150504595",
"94838349027009757481578313348081395710",
"6558385312899840733581268353543385062",
"87874226717630015567542419401463517566",
"97138942568293774060880255182550366807",
"306527021067248438201971020415997696196",
"151654978178026130299455721261142009321",
"15202474405836472904011734482736006051",
"73477568560126093239456570523406862860",
"136237735319956363673409768762352098507",
"85884934687734160305115908152670007961",
"288803407834371553549814697249372735847",
"304933540476430495714923316860082516341",
"21538088030859368492557831730280620151",
"169187916494429913041915914613123879477",
"287422178112916007200578655372425759384",
"6626872100692026679168025429194639867",
"206375774623428920841814124916850841916",
"149359505381145829146744602276428373257",
"230461827707002382362881011993206643688",
"261561772240703912027897635129437430643",
"338937505239138963718829381694582985268",
"112499050883979626025493075139890874147",
"241920367959694146559942763253031375590",
"78433535315699003734478076437575345229",
"131741404082895443362500605612690361800",
"39683071750205409489537503513533428680",
"97018141823391526804418702967710319033",
"177191404462661613789424113224262021214",
"129845873133191568953762808756726623819"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2026-70367-b692bebb",
"source": "https://github.com/mtrojnar/stunnel/commit/62ab5ccf33485b81bc4eaf0c76fd5558d2458e08"
},
{
"target": {
"function": "dtls_cookie_compute",
"file": "src/ctx.c"
},
"digest": {
"length": 1006.0,
"function_hash": "136862545749011322725837482466535404917"
},
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2026-70367-b6a2a064",
"source": "https://github.com/mtrojnar/stunnel/commit/62ab5ccf33485b81bc4eaf0c76fd5558d2458e08"
},
{
"target": {
"function": "protocol_init",
"file": "src/protocol.c"
},
"digest": {
"length": 2755.0,
"function_hash": "27458181217549793935512219596012534716"
},
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2026-70367-c9a57d04",
"source": "https://github.com/mtrojnar/stunnel/commit/62ab5ccf33485b81bc4eaf0c76fd5558d2458e08"
},
{
"target": {
"file": "src/dhparam.c"
},
"digest": {
"line_hashes": [
"39001130716613290694379770842434664803",
"48285161864877826305469188252204726957",
"256624542896984683670901545437993118555",
"200151042239090958857741408992571981513",
"43147295910286679689646960829351502754",
"114873628657451602346179252710820885527",
"37321592834709126679582166045278160683",
"122339918833171822286391156055076097795",
"159133361786240552949204570448680373168",
"250122285501952055697179335013202572977",
"150992081543706948070418822712529061925",
"301571215896974438530208542167860580352",
"326772253312191849193030337018411694090",
"116414441635768502766104629598210662861",
"172918858682095084661054526581976948785",
"564238065123475346561946260709491806",
"283060988283243275423529922341628913309",
"109677772688721841600924170545168210877",
"56036235756310472432762089676455361243",
"28026094492217190267167102831524926959",
"328271677114902318952649448866134476815",
"201918946840594633658625084746016804948",
"120541803284981256296631692672334663819",
"196607952628169644984525350333572487472",
"65651358584458166368814656729352784287",
"240966815161641244590418162312667484960"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2026-70367-e26474d7",
"source": "https://github.com/mtrojnar/stunnel/commit/62ab5ccf33485b81bc4eaf0c76fd5558d2458e08"
},
{
"target": {
"function": "control_pipe_server_thread",
"file": "src/ui_win_gui.c"
},
"digest": {
"length": 1278.0,
"function_hash": "162225123982159316146254761946652149358"
},
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2026-70367-f0244bad",
"source": "https://github.com/mtrojnar/stunnel/commit/62ab5ccf33485b81bc4eaf0c76fd5558d2458e08"
},
{
"target": {
"function": "validate_connect_addr",
"file": "src/protocol.c"
},
"digest": {
"length": 853.0,
"function_hash": "129234256943673869284925799732962305439"
},
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2026-70367-ffd9f3f3",
"source": "https://github.com/mtrojnar/stunnel/commit/62ab5ccf33485b81bc4eaf0c76fd5558d2458e08"
}
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-70367.json"