CVE-2026-70368
Medium
Description
A stack-based out-of-bounds read vulnerability exists in the "s_vlog" function of stunnel, when handling oversized log messages via "vsnprintf". A remote attacker with network access to a stunnel service can send protocol inputs that trigger a log message longer than 1024 bytes, leading to an out-of-bounds stack read and a potential crash. In certain corner cases, the same vulnerability could be used to replace a series of trailing "\n" characters with "\0".
SeverityMedium
CVSS6.5
Exploit probability—
Product
Mobi-com Polska Sp. Z O.o. Stunnel
PublishedAug 4, 2026
First seenAug 4, 2026
Weakness typeCWE-125Out-of-bounds read
How to fix
Update
- Mobi-Com Polska Sp. z o.o. stunnel5.80 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Mobi-Com Polska Sp. z o.o. stunnel | 5.68 ≤ v < 5.80 | 5.80 |
| Red Hat Red Hat Enterprise Linux 10 | No range specified | — |
| Red Hat Red Hat Enterprise Linux 8 | No range specified | — |
| Red Hat Red Hat Enterprise Linux 9 | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.