The vulnerability in stunnel 5.79 and earlier enables a Server‑Side Request Forgery attack when the DNS mapping for a client request includes an IPv4‑mapped IPv6 address such as "::ffff:127.0.0.1" or an unspecified address like "0.0.0.0" or "::". These special addresses cause stunnel, running in SOCKS proxy mode, to make a connection to the local host instead of the intended remote target, thereby exposing loopback‑only services to an external client. The flaw does not allow arbitrary code execution, but it can lead to information disclosure or service interaction that should be limited to internal use, representing a medium‑severity risk.

The affected software is the stunnel program (Open‑Source SSL/TLS tunneling daemon). Versions up to and including 5.79 are vulnerable when configured to provide a SOCKS proxy. No specific vendor‑product names are listed beyond the stunnel package itself, and the vulnerability is present whenever stunnel is operational in this mode.

The CVSS score of 5.4 indicates medium severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploits yet. The likely attack vector is remote: an attacker who can reach the stunnel SOCKS endpoint can craft a request using the special addresses to force the daemon to connect to localhost. Lack of authentication or network segmentation around the stunnel service increases the risk, while proper firewall limits and isolation mitigate the attacker’s ability to reach the vulnerable endpoint.