MGASA-2026-0575: Updated stunnel package fixes security vulnerabilities
Published Nov 5, 2026
·Updated
Localhost-filter bypass in SOCKS server mode. (CVE-2026-70367) Out-of-bounds memory access when logging long protocol messages. (CVE-2026-70368)
Affected Software
1 affected componentFixes available
mageia/stunnel<5.80-1.mga10
5.80-1.mga10
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mageia/stunnelto a version that resolves this vulnerability.Fixed in 5.80-1.mga10
Event History
Nov 5, 2026
Advisory Published
via OSV·05:11 AM
Data Sourced
via OSV·05:11 AM
DescriptionAffected Software
Frequently Asked Questions
1
Which stunnel deployments are affected by the localhost-filter issue?
The issue applies to stunnel when it is operating in SOCKS server mode, where the localhost filter can be bypassed. The advisory does not state whether this mode is enabled by default.
2
What is known about the impact of the logging issue?
The logging issue involves out-of-bounds memory access when stunnel logs long protocol messages. The provided advisory data does not specify exploit prerequisites, impact, or a workaround.