CVE-2026-70367 Details

A Server-Side Request Forgery (SSRF) bypass vulnerability has been identified in stunnel versions through 5.79, when the application is configured to use SOCKS proxy mode. This vulnerability allows clients to circumvent localhost restrictions by exploiting IPv4-mapped IPv6 addresses or unspecified addresses, such as '0.0.0.0' or '::'. As a result, attackers can access loopback-only services on the stunnel host that are not meant to be reachable over the network.

If SOCKS proxying is not needed, disable the 'protocol = socks' configuration in stunnel. If it is required, restrict access to the SOCKS listener by binding it to a trusted management network or localhost, and enforce client authentication or network ACL controls. Consider running stunnel in a container or network namespace where no other services are bound to localhost, or add firewall rules to limit outgoing connections from stunnel to localhost.