{"id":"CVE-2026-70368","summary":"Stunnel: stack-based out-of-bounds read/write in stunnel s_vlog via oversized log message","details":"A stack-based out-of-bounds read vulnerability exists in the \"s_vlog\" function of stunnel, when handling oversized log messages via \"vsnprintf\". A remote attacker with network access to a stunnel service can send protocol inputs that trigger a log message longer than 1024 bytes, leading to an out-of-bounds stack read and a potential crash. In certain corner cases, the same vulnerability could be used to replace a series of trailing \"\\n\" characters with \"\\0\".","modified":"2026-08-10T08:05:09.046108Z","published":"2026-08-04T13:52:25.255Z","database_specific":{"cna_assigner":"redhat","cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/70xxx/CVE-2026-70368.json"},"references":[{"type":"WEB","url":"https://access.redhat.com/downloads/content/package-browser/"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-70368"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/70xxx/CVE-2026-70368.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70368"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2462029"},{"type":"PACKAGE","url":"https://github.com/mtrojnar/stunnel"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/mtrojnar/stunnel","events":[{"introduced":"86fdef8fcf07596cdaf333aa318f4d65e0310b4b"},{"fixed":"62ab5ccf33485b81bc4eaf0c76fd5558d2458e08"}],"database_specific":{"extracted_events":[{"introduced":"5.68"},{"fixed":"5.80"}],"source":"AFFECTED_FIELD"}}],"versions":["stunnel-5.79","stunnel-5.78","stunnel-5.77","stunnel-5.76","stunnel-5.75","stunnel-5.74","stunnel-5.73","stunnel-5.72","stunnel-5.71","stunnel-5.70","stunnel-5.69","stunnel-5.68"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-70368.json","vanir_signatures_modified":"2026-08-10T08:05:09Z","vanir_signatures":[{"source":"https://github.com/mtrojnar/stunnel/commit/62ab5ccf33485b81bc4eaf0c76fd5558d2458e08","target":{"file":"src/log.c","function":"s_vlog"},"deprecated":false,"digest":{"length":1453,"function_hash":"53216965347798639662756561830214041258"},"id":"CVE-2026-70368-2f7bd336","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/mtrojnar/stunnel/commit/62ab5ccf33485b81bc4eaf0c76fd5558d2458e08","target":{"file":"src/ui_win_gui.c"},"deprecated":false,"digest":{"line_hashes":["300838760740498916727528886639410290551","210841920785737346975577575429436250958","78656332006269252407677460046937969392","137016240559842971849956920891464825845"],"threshold":0.9},"id":"CVE-2026-70368-3c5f22e5","signature_type":"Line","signature_version":"v1"},{"target":{"file":"src/verify.c","function":"init_crl"},"deprecated":false,"digest":{"function_hash":"117107876511809418361048565180966924289","length":431},"id":"CVE-2026-70368-467b2433","signature_type":"Function","signature_version":"v1","source":"https://github.com/mtrojnar/stunnel/commit/62ab5ccf33485b81bc4eaf0c76fd5558d2458e08"},{"target":{"file":"src/options.c"},"deprecated":false,"digest":{"line_hashes":["3595484820298666199007738651285703744","61243559595004869557226526021126009918","289281473792286056188061846290048890628"],"threshold":0.9},"id":"CVE-2026-70368-4cf0aa94","signature_type":"Line","signature_version":"v1","source":"https://github.com/mtrojnar/stunnel/commit/62ab5ccf33485b81bc4eaf0c76fd5558d2458e08"},{"digest":{"line_hashes":["305208808442846169172785283557932203609","49897403995536265552834653516750509732","81365332215018368336627963622394636500","288054664844844721837181395654061296907","202119073354156763254595906367678325539","217500080667019106098429745038189413628","48596394056935550994801752276856257256","288209864533071369295542124727426463126"],"threshold":0.9},"id":"CVE-2026-70368-53c9cf77","signature_type":"Line","signature_version":"v1","source":"https://github.com/mtrojnar/stunnel/commit/62ab5ccf33485b81bc4eaf0c76fd5558d2458e08","target":{"file":"src/verify.c"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/mtrojnar/stunnel/commit/62ab5ccf33485b81bc4eaf0c76fd5558d2458e08","target":{"file":"src/options.c","function":"parse_service_option"},"deprecated":false,"digest":{"function_hash":"64879305346802684165508371114421348087","length":64629},"id":"CVE-2026-70368-583e09b8","signature_type":"Function"},{"source":"https://github.com/mtrojnar/stunnel/commit/62ab5ccf33485b81bc4eaf0c76fd5558d2458e08","target":{"file":"src/log.c"},"deprecated":false,"digest":{"line_hashes":["106561923383099257648051938344888754867","40512398613990358635255278301946200882","165577672410587669060666359750527418686","195851150840538001280551410431183071888","217763584644850009221685104870594782244","300359778945180731035287253679303480260","4118837184956830265451429077069028117","222898659805546514570924520518982303812","179378134336620383423818866738297090080","115702188164251621936582106853986577697","247005539948712601793246124994688094273","276639754083654034991848216786181349603","102481446655614188069138356003102772262","54606571580269571786719277356596128162","13634748769862555093170026253438904231","153049223675756150089892250844059221293","48072012794901446343167121075361580589","129486167377240480722816258758538835408","46964258922570412732623373457147478781"],"threshold":0.9},"id":"CVE-2026-70368-778fb6fd","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/mtrojnar/stunnel/commit/62ab5ccf33485b81bc4eaf0c76fd5558d2458e08","target":{"file":"src/network.c","function":"dtls_listen"},"deprecated":false,"digest":{"function_hash":"63685943870807076004836130448047440180","length":3006},"id":"CVE-2026-70368-7addb8aa","signature_type":"Function"},{"source":"https://github.com/mtrojnar/stunnel/commit/62ab5ccf33485b81bc4eaf0c76fd5558d2458e08","target":{"file":"src/stunnel.c"},"deprecated":false,"digest":{"line_hashes":["224476903368059129088253117635793033161","95676811420737608448105044452961885035","277449470398892913196999218081764900834","61683903780567750178674089514894792374"],"threshold":0.9},"id":"CVE-2026-70368-7ca45736","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/mtrojnar/stunnel/commit/62ab5ccf33485b81bc4eaf0c76fd5558d2458e08","target":{"file":"src/network.c"},"deprecated":false,"digest":{"line_hashes":["282904634021523432099740069901111592057","301891425985895554850074648233743015876","116889016659417332762474641099410381009","328329031847488551026822447059103287852","231595044359278575038254100062261827606","84849263762338542932081593428556417195","133233553870381822770162452552651888557","208701068504914444961967037103657562370","253814635602608279655953629650241781281","242219530177325359126456546701269306246","195358324637367735063590313513259704278","151324662007513787101659524867109510056","21509194815764525221479874148011751041","152091286174935672228041789135906686352"],"threshold":0.9},"id":"CVE-2026-70368-88b4611b","signature_type":"Line","signature_version":"v1"},{"digest":{"line_hashes":["56813137796924886102757803902908937252","266925903033147225687032691342129448383","38855167165941264799487086074552108033","118461857011106602919833769184812660885","237556975517355647914539436981268352409","137957657660332967620391276657126710189","270139362318323238943685376639178912282","328782703006270182165483712370838731348","337325127734518094582748941087059902830","73086603380512312944094213450753145741","293870156063566655736501111771082232338","105357671582551525773010310514541063615","27632273418513752965969045762132970528","224295401182790266451606196355313178470","17195565764813013532526394098636540287","178119157922127323354068875760225028910","233145900419718712504006039194051865303","11485458874039607521360520809317106878","229290700631675946732833917514016047490","201784219638114518727892522386745817848","71601270029996363610891228675104975081","95596227634321196271634296830082853867","32040988405666457312490667641748772779","52962655628619720339408012467865604387","16372303524408099661807943234443067219","223459523862732234087957583510172540215","245207877947611695120067873272294634813","89765094359128082782236064786726465725","210711390711214150506577598680496062130","169298879273301068425682026976510020185","320484373244194393617863195142333906256","145563497409814980921410631065142279629","299898962488927685049163193277802049738","58452355391722944920121149315408531905","62420137830295422660321628071470470279","202925201278314957611232686911129350832","162140369757971352240665492418693732183","109780362930743688055665950617925110652","208036688712268303393194306728397626660","306805989803594658822889198106397158976"],"threshold":0.9},"id":"CVE-2026-70368-93322907","signature_type":"Line","signature_version":"v1","source":"https://github.com/mtrojnar/stunnel/commit/62ab5ccf33485b81bc4eaf0c76fd5558d2458e08","target":{"file":"src/ctx.c"},"deprecated":false},{"source":"https://github.com/mtrojnar/stunnel/commit/62ab5ccf33485b81bc4eaf0c76fd5558d2458e08","target":{"file":"src/dhparam.c","function":"get_dh2048"},"deprecated":false,"digest":{"function_hash":"159635595401001736683120108524735221206","length":2246},"id":"CVE-2026-70368-ad2c9520","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/mtrojnar/stunnel/commit/62ab5ccf33485b81bc4eaf0c76fd5558d2458e08","target":{"file":"src/prototypes.h"},"deprecated":false,"digest":{"line_hashes":["126508024106151707137244321232375954370","103792203274801738617698431901013391667","205080902813143253882568403547051000266","158113002667331642090488681807851900916","339448637209400088044227204305470811356","299407735322427970221451600072749697264","312969468237109667340906542786394972148","259447220107295144595622188341804279378"],"threshold":0.9},"id":"CVE-2026-70368-b15846a9"},{"source":"https://github.com/mtrojnar/stunnel/commit/62ab5ccf33485b81bc4eaf0c76fd5558d2458e08","target":{"function":"start_accepted_client","file":"src/stunnel.c"},"deprecated":false,"digest":{"length":483,"function_hash":"277313936857424386489486146750375268756"},"id":"CVE-2026-70368-b1e7a216","signature_type":"Function","signature_version":"v1"},{"digest":{"line_hashes":["106817755265728803005935388339126119101","191203130864686603109179986776802837471","23483154084798263637854670020486929955","26261821084995321877017721726194006935","26690366476211614493602718003019870020","145512478266416937696220760146389236560","59745917587955298150955156790005907032","315569497074856475405720030538284059933","288827174947277749080233742815586837825","302771814393177114445771178313663245296","84556893231601023227410800181027615793","6837809024966058093295258928087524963","89748228357177699831669580004615189535","194655591278560290627629273451516172854","230257226135366131765746008050784318119","102081830382464546002719620235960180174","33774881589452957833536935891942122691","150754429060852009260668705226030332378","79859354937262399672176403952185637782","41469861174330198069807527190883834876","70085759035616938260085533513307762016","176353860690808089908279172095593885116","96905979811653118754864244456233555785","301131629925296514391620569818016518072","227892939700472813998570146468359513309","249507442198257331046367480906270942798","274889401759826922160645496488153282482","288894015835770128914401200927971954392","299733773104211564213618081544873184671","276851970441693582769722256725615258461","136691965164946861142620531856014077432","148186843770949526710272346758866592127","90542835371171410037944064512202692672","4904313314805110413823257274835616631","36699791929072691383014428303857180029","30387412032999248764368636005186337318","163702922035100501485827117107240375250","137410187597478550555994064767022181609","134595669296718233732548213613381204523","253979956317251108323289177360665826655","329754285052463181516576688221802931382","259778893534354674507957185928591844059","260609435002562614439883394297651694651","75863566715294305171220883375504875997","133059347511697810022433346830096200998","253425426310681997063385137556220528538","314422146190205774076587975991150504595","94838349027009757481578313348081395710","6558385312899840733581268353543385062","87874226717630015567542419401463517566","97138942568293774060880255182550366807","306527021067248438201971020415997696196","151654978178026130299455721261142009321","15202474405836472904011734482736006051","73477568560126093239456570523406862860","136237735319956363673409768762352098507","85884934687734160305115908152670007961","288803407834371553549814697249372735847","304933540476430495714923316860082516341","21538088030859368492557831730280620151","169187916494429913041915914613123879477","287422178112916007200578655372425759384","6626872100692026679168025429194639867","206375774623428920841814124916850841916","149359505381145829146744602276428373257","230461827707002382362881011993206643688","261561772240703912027897635129437430643","338937505239138963718829381694582985268","112499050883979626025493075139890874147","241920367959694146559942763253031375590","78433535315699003734478076437575345229","131741404082895443362500605612690361800","39683071750205409489537503513533428680","97018141823391526804418702967710319033","177191404462661613789424113224262021214","129845873133191568953762808756726623819"],"threshold":0.9},"id":"CVE-2026-70368-b692bebb","signature_type":"Line","signature_version":"v1","source":"https://github.com/mtrojnar/stunnel/commit/62ab5ccf33485b81bc4eaf0c76fd5558d2458e08","target":{"file":"src/protocol.c"},"deprecated":false},{"digest":{"length":1006,"function_hash":"136862545749011322725837482466535404917"},"id":"CVE-2026-70368-b6a2a064","signature_type":"Function","signature_version":"v1","source":"https://github.com/mtrojnar/stunnel/commit/62ab5ccf33485b81bc4eaf0c76fd5558d2458e08","target":{"file":"src/ctx.c","function":"dtls_cookie_compute"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/mtrojnar/stunnel/commit/62ab5ccf33485b81bc4eaf0c76fd5558d2458e08","target":{"file":"src/protocol.c","function":"protocol_init"},"deprecated":false,"digest":{"function_hash":"27458181217549793935512219596012534716","length":2755},"id":"CVE-2026-70368-c9a57d04","signature_type":"Function"},{"digest":{"line_hashes":["39001130716613290694379770842434664803","48285161864877826305469188252204726957","256624542896984683670901545437993118555","200151042239090958857741408992571981513","43147295910286679689646960829351502754","114873628657451602346179252710820885527","37321592834709126679582166045278160683","122339918833171822286391156055076097795","159133361786240552949204570448680373168","250122285501952055697179335013202572977","150992081543706948070418822712529061925","301571215896974438530208542167860580352","326772253312191849193030337018411694090","116414441635768502766104629598210662861","172918858682095084661054526581976948785","564238065123475346561946260709491806","283060988283243275423529922341628913309","109677772688721841600924170545168210877","56036235756310472432762089676455361243","28026094492217190267167102831524926959","328271677114902318952649448866134476815","201918946840594633658625084746016804948","120541803284981256296631692672334663819","196607952628169644984525350333572487472","65651358584458166368814656729352784287","240966815161641244590418162312667484960"],"threshold":0.9},"id":"CVE-2026-70368-e26474d7","signature_type":"Line","signature_version":"v1","source":"https://github.com/mtrojnar/stunnel/commit/62ab5ccf33485b81bc4eaf0c76fd5558d2458e08","target":{"file":"src/dhparam.c"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"162225123982159316146254761946652149358","length":1278},"id":"CVE-2026-70368-f0244bad","signature_type":"Function","signature_version":"v1","source":"https://github.com/mtrojnar/stunnel/commit/62ab5ccf33485b81bc4eaf0c76fd5558d2458e08","target":{"file":"src/ui_win_gui.c","function":"control_pipe_server_thread"}},{"deprecated":false,"digest":{"function_hash":"129234256943673869284925799732962305439","length":853},"id":"CVE-2026-70368-ffd9f3f3","signature_type":"Function","signature_version":"v1","source":"https://github.com/mtrojnar/stunnel/commit/62ab5ccf33485b81bc4eaf0c76fd5558d2458e08","target":{"file":"src/protocol.c","function":"validate_connect_addr"}}]}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"}]}