A Server-Side Request Forgery (SSRF) bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses (e.g., “::ffff:127.0.0.1”) or unspecified addresses ("0.0.0.0", "::"), enabling access to loopback-only services on the "stunnel" host that should not be network-reachable.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4617-1 advisory.

    - CVE-2026-70367: incomplete IP address filtering in SOCKS proxy mode can allow localhost restriction     bypasses       (bsc#1274207).
    - CVE-2026-70368: oversized log messages in logging routines can cause stack out-of-bounds reads     (bsc#1274206).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A Server-Side Request Forgery (SSRF) bypass vulnerability exists in “stunnel” 5.79 and lower when
    configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by
    using IPv4-mapped IPv6 addresses (e.g., “::ffff:127.0.0.1”) or unspecified addresses ("0.0.0.0", "::"),
    enabling access to loopback-only services on the "stunnel" host that should not be network-reachable.
    (CVE-2026-70367)

  - A stack-based out-of-bounds read vulnerability exists in the "s_vlog" function of stunnel, when handling
    oversized log messages via "vsnprintf". A remote attacker with network access to a stunnel service can
    send protocol inputs that trigger a log message longer than 1024 bytes, leading to an out-of-bounds stack
    read and a potential crash. In certain corner cases, the same vulnerability could be used to replace a
    series of trailing "\n" characters with "\0". (CVE-2026-70368)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-de8630b736 advisory.

    ```
    * Security bugfixes
     - CVE-2026-70368: Fixed an out-of-bounds memory access triggered by        logging attacker-controlled protocol messages longer than 1,024 bytes        (thanks to AISLE Research and Clemens Lang).
     - CVE-2026-70367: Fixed a SOCKS server mode bypass of the localhost        destination filter using alternate local-address encodings and        interface-scoped IPv6 destinations (thanks to AISLE Research and        Clemens Lang).
     - Restricted Windows GUI/service control pipes to local clients.
    * Bugfixes
     - Fixed concurrent DTLS handshakes from clients sharing an IP address.
     - Fixed version reporting in builds from source.
     - Rejected stream-oriented protocol negotiation with the UDP transport        during configuration validation.
     - Fixed a TCP stream truncation (thanks to Solomon Jacobs).
     - Fixed a transfer() loop (thanks to Solomon Jacobs).
     - Fixed log reopening logs without a configured log file.
     - Fixed some logged values (thanks to Jose Alf.).
     - Fixed some error handling and cleanup issues (thanks to Jose Alf.).
     - Fixed OpenSSL applink detection and MSYS2 MinGW builds.
    * Features
     - Added the CRLcheckChain service-level option for opt-in full-chain        CRL verification.
     - Added the new 'transport' service-level option to choose between TLS        over TCP and DTLS over UDP.
    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-67c2201ad8 advisory.

    ```
    * Security bugfixes
     - CVE-2026-70368: Fixed an out-of-bounds memory access triggered by        logging attacker-controlled protocol messages longer than 1,024 bytes        (thanks to AISLE Research and Clemens Lang).
     - CVE-2026-70367: Fixed a SOCKS server mode bypass of the localhost        destination filter using alternate local-address encodings and        interface-scoped IPv6 destinations (thanks to AISLE Research and        Clemens Lang).
     - Restricted Windows GUI/service control pipes to local clients.
    * Bugfixes
     - Fixed concurrent DTLS handshakes from clients sharing an IP address.
     - Fixed version reporting in builds from source.
     - Rejected stream-oriented protocol negotiation with the UDP transport        during configuration validation.
     - Fixed a TCP stream truncation (thanks to Solomon Jacobs).
     - Fixed a transfer() loop (thanks to Solomon Jacobs).
     - Fixed log reopening logs without a configured log file.
     - Fixed some logged values (thanks to Jose Alf.).
     - Fixed some error handling and cleanup issues (thanks to Jose Alf.).
     - Fixed OpenSSL applink detection and MSYS2 MinGW builds.
    * Features
     - Added the CRLcheckChain service-level option for opt-in full-chain        CRL verification.
     - Added the new 'transport' service-level option to choose between TLS        over TCP and DTLS over UDP.
    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of stunnel installed on the remote host is prior to 5.80. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2026-216-01 advisory.

    New stunnel packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the stunnel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A Server-Side Request Forgery (SSRF) bypass vulnerability exists in stunnel 5.79 and lower when     configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by     using IPv4-mapped IPv6 addresses (e.g., ::ffff:127.0.0.1) or unspecified addresses (0.0.0.0, ::),     enabling access to loopback-only services on the stunnel host that should not be network-reachable.
    (CVE-2026-70367)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
365324	SUSE SLES15 Security Update : stunnel (SUSE-SU-2026:4617-1)	Nessus	SuSE Local Security Checks	Local	medium
448462	Alpine: stunnel: security update to 5.82-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	medium
448462	Alpine: stunnel: security update to 5.82-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	medium
335901	Fedora 43 : stunnel (2026-de8630b736)	Nessus	Fedora Local Security Checks	Local	medium
335896	Fedora 44 : stunnel (2026-67c2201ad8)	Nessus	Fedora Local Security Checks	Local	medium
332077	Slackware Linux 15.0 / current stunnel Multiple Vulnerabilities (SSA:2026-216-01)	Nessus	Slackware Local Security Checks	Local	medium
331947	Linux Distros Unpatched Vulnerability : CVE-2026-70367	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-70367

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium