Technical impact
The vulnerability resides in the s_vlog function, which uses vsnprintf to format log messages. When an attacker sends a protocol message that triggers a log entry longer than 1,024 bytes, the function performs an out‑of‑bounds read from the stack, potentially causing a crash. In certain edge cases the read may also allow alteration of trailing newline characters to null bytes, which could further destabilize the application. The impact is primarily a service disruption, as the crash leads to denial of service for legitimate users.
Affected Systems
This vulnerability affects stunnel installations packaged for Red Hat Enterprise Linux 6, 7, 8, 9, and 10. The affected releases are those contained in the kernel distributions listed; specific version numbers are not provided in the CVE data, so all prior versions of the stunnel package in these distributions should be considered at risk.
Risk and Exploitability
This is a moderate‑severity vulnerability with a CVSS score of 6.5. The EPSS score is unavailable, and the issue is not currently listed in the CISA KEV catalog. The attack vector is remote over the network; a malicious client can directly craft oversized log messages against the service. Operator exposure is limited to correctly reaching the vulnerable stunnel instance, without requiring privileged local access.
