Veille CVE

Mardi 4 août 2026

2 CVE sur 6

Critique 0 Élevée 2 Moyenne 2 Faible 2 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Red Hat Enterprise Linux 7 » ✕
  1. CVE-2026-70368 6.5 Moyenne

    Mobi-Com Polska Sp. z o.o. stunnel · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 7

    A stack-based out-of-bounds read vulnerability exists in the "s_vlog" function of stunnel, when handling oversized log messages via "vsnprintf". A remote attacker with network access to a stunnel service can send protocol inputs that trigger a log message longer than 1024 bytes, leading to an out-of-bounds stack read and a potential crash. In certain corner cases, the same vulnerability could be used to replace a series of trailing "\n" characters with "\0".

  2. CVE-2026-70367 5.4 Moyenne

    Mobi-Com Polska Sp. z o.o. stunnel · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 7

    A Server-Side Request Forgery (SSRF) bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses (e.g., “::ffff:127.0.0.1”) or unspecified addresses ("0.0.0.0", "::"), enabling access to loopback-only services on the "stunnel" host that should not be network-reachable.