PT-2026-67712

CVE-2026-70367

Published

2026-08-04

Updated

2026-10-12

Description by

CVSS 3.1

5.4

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions stunnel versions prior to 5.80

Description A Server-Side Request Forgery (SSRF) bypass occurs when the software is configured in SOCKS proxy mode. This issue allows a client to circumvent localhost restrictions by utilizing unspecified addresses such as "0.0.0.0" and "::", or IPv4-mapped IPv6 addresses like "::ffff:127.0.0.1". Consequently, an attacker can gain access to loopback-only services on the host that are intended to be unreachable from the network.

Recommendations Update to a version newer than 5.79.

Exploitability

Exploit

Fix

Impacts

Researchers

Found By

Vendors

Affected products

Weakness enumeration

CWE-918: Server-Side Request Forgery (SSRF)

Related identifiers