SSRF Bypass in Stunnel via IPv4-Mapped IPv6

Executive Summary

CVE-2026-70367 is a Server-Side Request Forgery (SSRF) bypass vulnerability in stunnel versions 5.79 and lower when configured in SOCKS proxy mode. It allows attackers to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses like ::ffff:127.0.0.1 or unspecified addresses such as 0.0.0.0 or ::. This enables access to loopback-only services on the stunnel host that should not be network-reachable.

Useful 0 Not Useful 0

Detection Guidance

Check if stunnel is running in SOCKS proxy mode by inspecting its configuration file for 'protocol = socks'. Verify if the SOCKS listener is exposed to untrusted networks using netstat or ss commands like 'ss -tulnp | grep stunnel' or 'netstat -tulnp | grep stunnel'.

Test for vulnerable addresses by attempting to connect to loopback services via IPv4-mapped IPv6 (::ffff:127.0.0.1) or unspecified addresses (0.0.0.0, ::) using tools like curl or nc. Monitor logs for unusual access attempts to localhost-bound services.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers who can reach the SOCKS listener to bypass localhost restrictions and access loopback-only services on the stunnel host. This could lead to exposure of administrative or metadata services, unauthorized access to protected resources, and potential limited integrity or availability disruption.

Useful 0 Not Useful 0

Mitigation Strategies

Disable the SOCKS proxy mode in stunnel if not required by removing or commenting out 'protocol = socks' in the configuration file and restarting stunnel.

Restrict access to the SOCKS listener by binding it to localhost (127.0.0.1) or a trusted internal IP using the 'accept' directive in the configuration.

Enforce client authentication for the SOCKS proxy to limit unauthorized access until a patch is applied.

Isolate stunnel in a container with no local services or network access to loopback-only resources as an additional precaution.

Useful 0 Not Useful 0