CVE-2026-70368

Summary

The flaw is a stack-based out-of-bounds read vulnerability in stunnel's 's_vlog' function when handling oversized log messages. This can lead to crashes and potentially replace trailing newline characters with null bytes.

Exploitability

Exploitation requires network access to the stunnel service and sending protocol inputs that trigger a log message longer than 1024 bytes, making it moderately difficult.

Blast radius

If exploited, this could result in service disruptions or data corruption, impacting system reliability.

Prioritized remediation

Update stunnel to a patched version immediately.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.