5.4

CVE-2026-70367: Stunnel: ssrf bypass in stunnel socks proxy via ipv4-mapped ipv6 loopback and unspecified addresses allows access to loopback-only services

Awaiting analysis
AliasesDEBIAN-CVE-2026-70367ALPINE-CVE-2026-70367
Published 04-08-2026Last modified 06-08-2026

Vulnerability summary

CVE-2026-70367 is a medium (CVSS 5.4) Server-Side Request Forgery vulnerability in mobi-com polska sp. z o.o. stunnel. EPSS estimates a 0.16% chance of exploitation in the next 30 days, higher than 4.7% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 5.4, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
5.4/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.16%
0%100%
Low · -0.10 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 4 · Related 4
OPENSUSE-SU-2026:11500-1OPENSUSE-SU-2026:22088-1SUSE-SU-2026:24232-1SUSE-SU-2026:4617-1

Timeline

  1. 04-08-2026
    PublishedVulnerability first disclosed.
  2. 06-08-2026
    Last modifiedVulnerability information updated.

Description

A Server-Side Request Forgery (SSRF) bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses (e.g., “::ffff:127.0.0.1”) or unspecified addresses ("0.0.0.0", "::"), enabling access to loopback-only services on the "stunnel" host that should not be network-reachable.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.16%

Chance of exploitation in the next 30 days

Percentile

5%

Versus all other CVEs

30-day change

Decrease -0.10 pp

From 0.26% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Debian2 products
  • stunnel< 3:5.80-1
  • stunnel4All versions (No fix recorded)
Alpine1 product
  • stunnel< 5.82-r0
Mobi-com polska sp. z o.o.1 product

3 vendors · 4 products

References

4 links