What is CVE-2026-70367?

CVE-2026-70367 is a medium-severity vulnerability in Red Hat Enterprise Linux 10, classified under Server-Side Request Forgery (SSRF). CVSS score: 5.4/10. Published 2026-08-04.

How severe is CVE-2026-70367?

Medium severity. CVSS v3 base score is 5.4 out of 10.

SSRF in Red Hat Enterprise Linux 10

CVE-2026-70367

A Server-Side Request Forgery (SSRF) bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses (e.g…

Vulnerability class: SSRF (Server-Side Request Forgery)

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N.

Affected products

Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9

Weakness classification (CWE)

CWE-918 — Server-Side Request Forgery (SSRF)

References

secalert@redhat.com (x_refsource_REDHAT, vdb-entry)
secalert@redhat.com (x_refsource_REDHAT, issue-tracking)

Frequently asked questions

What is CVE-2026-70367?: CVE-2026-70367 is a medium-severity vulnerability in Red Hat Enterprise Linux 10, classified under Server-Side Request Forgery (SSRF). CVSS score: 5.4/10. Published 2026-08-04.
How severe is CVE-2026-70367?: Medium severity. CVSS v3 base score is 5.4 out of 10.