CVE-2026-70368

A stack-based out-of-bounds read vulnerability exists in the "s_vlog" function of stunnel, when handling oversized log messages via "vsnprintf". A remote attacker with network access to a stunnel service can send protocol inputs that trigger a log message longer than 1024 bytes, leading to an out-of-bounds stack read and a potential crash. In certain corner cases, the same vulnerability could be used to replace a series of trailing "\n" characters with "\0".

This Moderate impact vulnerability affects stunnel services if their configuration allows long attacker-controlled log messages. Server-side IMAP protocol negotiation ("protocol = imap") is known to be affected, where a remote, unauthenticated attacker can trigger a denial-of-service by sending an oversized IMAP command. Reliable integrity impact or code execution as a result of this issue would be very difficult and likely impractical. This issue specifically affects "stunnel" 5.79 and lower when exposed to untrusted networks.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid exposing stunnel services to untrusted clients. Restrict access to these services to trusted networks only.