Stack-Based Out-of-Bounds Read Vulnerability in Stunnel by Red Hat

CVE-2026-70368

What is CVE-2026-70368?

A stack-based out-of-bounds read vulnerability exists in the 's_vlog' function of Stunnel, specifically occurring when processing oversized log messages via 'vsnprintf'. This flaw allows a remote attacker with network access to send protocol inputs that can generate a log message exceeding 1024 bytes. Such conditions could result in an out-of-bounds read from the stack, potentially leading to service crashes. In specific instances, the flaw might also enable the attacker to replace trailing newline characters with null characters, creating further exploit opportunities. Organizations using affected versions of Stunnel should apply security patches as recommended by Red Hat.

References