Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-08-04T10:30:31 stunnel: Stack-based out-of-bounds read/write in stunnel s_vlog via oversized log message 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L CWE-125

A stack-based out-of-bounds read vulnerability exists in the "s_vlog" function of stunnel, when handling oversized log messages via "vsnprintf". A remote attacker with network access to a stunnel service can send protocol inputs that trigger a log message longer than 1024 bytes, leading to an out-of-bounds stack read and a potential crash. In certain corner cases, the same vulnerability could be used to replace a series of trailing "\n" characters with "\0".

A stack-based out-of-bounds read vulnerability exists in the "s_vlog" function of stunnel, when handling oversized log messages via "vsnprintf". A remote attacker with network access to a stunnel service can send protocol inputs that trigger a log message longer than 1024 bytes, leading to an out-of-bounds stack read and a potential crash. In certain corner cases, the same vulnerability could be used to replace a series of trailing "\n" characters with "\0".

This Moderate impact vulnerability affects stunnel services if their configuration allows long attacker-controlled log messages. Server-side IMAP protocol negotiation ("protocol = imap") is known to be affected, where a remote, unauthenticated attacker can trigger a denial-of-service by sending an oversized IMAP command. Reliable integrity impact or code execution as a result of this issue would be very difficult and likely impractical. This issue specifically affects "stunnel" 5.79 and lower when exposed to untrusted networks. This issue was discovered by Found by AISLE in partnership with Red Hat. To mitigate this issue, avoid exposing stunnel services to untrusted clients. Restrict access to these services to trusted networks only. Red Hat Enterprise Linux 10 Fix deferred stunnel Red Hat Enterprise Linux 6 Not affected stunnel Red Hat Enterprise Linux 7 Not affected stunnel Red Hat Enterprise Linux 8 Fix deferred stunnel Red Hat Enterprise Linux 9 Fix deferred stunnel https://www.cve.org/CVERecord?id=CVE-2026-70368 https://nvd.nist.gov/vuln/detail/CVE-2026-70368