CVE-2026-70368: Fedora 44 Stunnel 5.80 Fixes SOCKS Bypass and Key Memory Access Flaw — Patching and Detection Guide

Fedora has released an update for stunnel 5.80 on Fedora 44 (advisory FEDORA-2026-67c2201ad8) that remediates CVE-2026-70368, a vulnerability combining a SOCKS protocol negotiation bypass with a key memory access defect in the stunnel TLS encryption wrapper. For organizations that rely on stunnel to bolt TLS onto legacy plaintext services — databases, LDAP, mail relays, internal APIs — this is not a routine refresh. A SOCKS negotiation bypass undermines the access-control assumptions operators place on stunnel front-ends, and improper memory access around key material creates both a confidentiality exposure and a crash-driven denial-of-service path on the very component meant to be your cryptographic perimeter.

If you run stunnel on Fedora 44 — or build containers from Fedora base images that include it — treat this as a priority patch cycle. TLS terminators sit at trust boundaries by design; a flaw in protocol negotiation logic there is exactly where an attacker wants to be.

Technical Analysis

Affected products and platforms

How the vulnerability works

Stunnel operates as a proxy: it accepts plaintext (or TLS) connections, optionally negotiates through a SOCKS intermediary, and wraps traffic in TLS before forwarding it to the protected service. CVE-2026-70368 has two defender-relevant facets:

1. SOCKS negotiation bypass. Stunnel supports chaining outbound connections through SOCKS proxies (protocol and proxy-related options). A flaw in how SOCKS handshake responses are parsed and validated allows an attacker positioned at — or impersonating — the SOCKS hop to bypass expected negotiation constraints. From a defensive standpoint, this means a connection you believed was constrained by your SOCKS policy may be established outside those constraints, enabling traffic redirection or interception of what should be TLS-bound sessions.

2. Key memory access defect. Improper memory access involving private key material can expose sensitive bytes in memory and/or crash the stunnel process. On a multi-tenant TLS terminator, out-of-bounds or otherwise improper access near key material is a confidentiality concern; a crash primitive is an availability concern that takes down every service fronted by that stunnel instance.

The 5.80 update also hardens TLS protocol negotiation and client certificate verification code paths — the same classes of logic historically targeted for downgrade and validation-bypass attacks — so this release carries defensive value beyond the single CVE.

Exploitation requirements and status

• Exploitation requirements: For the SOCKS facet, the attacker needs to control or MITM the SOCKS proxy leg of the connection path, or operate a malicious SOCKS endpoint that stunnel clients are configured to traverse. For the memory access facet, the attacker needs to reach the stunnel listener with crafted input or influence the key-loading path.
• In-the-wild status: As of this writing, there is no confirmed public PoC, no confirmed active exploitation, and no CISA KEV listing for CVE-2026-70368. That is a patch window, not a reason to defer — TLS proxies are high-value, low-noise targets, and the gap between advisory and weaponization for network-facing daemons is measured in days, not months.

Detection & Response

Because stunnel is a Linux network daemon, detection centers on: (1) confirming vulnerable versions in your estate, (2) watching for stunnel crashes/restarts consistent with memory-access exploitation, and (3) auditing for unexpected SOCKS proxy configuration that would place your stunnel traffic across an attacker-controllable hop.

SIGMA Rules

---
title: Stunnel Service Crash or Unexpected Termination
tid: 9f2c1a47-3b6e-4d58-a921-7c4e5f0a1b2c
status: experimental
description: Detects stunnel process crashes, segfaults, or abnormal termination events consistent with exploitation of the CVE-2026-70368 key memory access defect. Correlate with patching status before dismissing.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-44-stunnel-2026-67c2201ad8
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1499
logsource:
  product: linux
  service: syslog
detection:
  selection:
    - Message|contains|all:
        - 'stunnel'
        - 'segfault'
    - Message|contains|all:
        - 'stunnel'
        - 'core dumped'
    - Message|contains|all:
        - 'stunnel'
        - 'signal 11'
  condition: selection
falsepositives:
  - Misconfigured stunnel instances crashing on startup (still worth investigation)
level: high
---
title: Stunnel SOCKS Proxy Configuration Observed
tid: 4e8d3b15-6a2f-4c97-b308-1d9e2f7a5c4b
status: experimental
description: Identifies stunnel configuration files or process command lines referencing SOCKS proxy chaining. In environments where SOCKS chaining is not an approved architecture, this may indicate attacker-modified configuration to route TLS-bound traffic through a malicious proxy, relevant to the CVE-2026-70368 SOCKS bypass facet.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-44-stunnel-2026-67c2201ad8
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1090
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine|contains:
      - 'stunnel'
  filter_socks_in_conf:
    CommandLine|contains:
      - 'socks'
  condition: selection and filter_socks_in_conf
falsepositives:
  - Legitimate stunnel deployments that intentionally chain through SOCKS proxies
level: medium

KQL — Microsoft Sentinel (Syslog/CEF ingestion)

Use this to hunt across your Linux estate for stunnel crash telemetry and to baseline which hosts are even running stunnel (often the first thing a Vulnerability Management team does not know):

// Hunt 1: stunnel crashes / memory-access indicators via Syslog
Syslog
| where TimeGenerated > ago(14d)
| where ProcessName =~ "stunnel" or SyslogMessage has "stunnel"
| where SyslogMessage has_any ("segfault", "core dumped", "signal 11", "Address boundary error", "General protection")
| project TimeGenerated, Computer, ProcessName, SyslogMessage, SeverityLevel
| order by TimeGenerated desc;

// Hunt 2: Inventory hosts running stunnel and flag unexpected SOCKS references
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has "stunnel"
| extend UsesSocks = SyslogMessage has "socks"
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), SocksRefs=countif(UsesSocks), TotalEvents=count() by Computer
| order by SocksRefs desc;

Velociraptor VQL

Hunt for stunnel processes, their version strings, and SOCKS references in configuration — useful for rapidly scoping exposure across a Linux fleet:

-- Scope stunnel exposure: running processes and SOCKS proxy configuration references
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ 'stunnel'
   OR CommandLine =~ 'stunnel'

-- Then enumerate config for SOCKS chaining
SELECT FullPath, Size, Mtime,
       read_file(filename=FullPath) AS ConfigContent
FROM glob(globs='/etc/stunnel/*.conf')
WHERE ConfigContent =~ '(?i)socks'

Remediation & Verification Script

#!/bin/bash
# CVE-2026-70368 - stunnel 5.80 verification and remediation for Fedora 44
# Run as root or via sudo.

set -euo pipefail

echo "=== Current stunnel version ==="
if rpm -q stunnel >/dev/null 2>&1; then
    rpm -q stunnel
else
    echo "stunnel not installed via rpm (check containers/flatpaks separately)"
    exit 0
fi

echo ""
echo "=== Applying Fedora update (FEDORA-2026-67c2201ad8) ==="
dnf -y update stunnel

echo ""
echo "=== Post-patch version check (expect 5.80 or later) ==="
NEWVER=$(rpm -q --queryformat '%{VERSION}' stunnel)
echo "Installed stunnel version: ${NEWVER}"
if [[ "${NEWVER}" < "5.80" ]]; then
    echo "[!] WARNING: version still below 5.80 - investigate repo mirror / advisory status"
    exit 1
fi

echo ""
echo "=== Restarting stunnel services ==="
systemctl list-units --type=service --state=running | grep -i stunnel || echo "No running stunnel systemd units found"
for svc in $(systemctl list-units --type=service --state=running --no-legend | awk '/stunnel/{print $1}'); do
    systemctl restart "${svc}"
    echo "Restarted: ${svc}"
done

echo ""
echo "=== Auditing for SOCKS proxy chaining in stunnel configs ==="
grep -RniE 'socks' /etc/stunnel/ 2>/dev/null || echo "No SOCKS references found in /etc/stunnel (expected for most deployments)"

echo ""
echo "=== Checking for recent stunnel crashes (memory-access exploitation indicator) ==="
journalctl --since "-14 days" | grep -iE 'stunnel.*(segfault|core dumped|signal 11)' || echo "No stunnel crash events in the last 14 days"

echo ""
echo "Done. Verify service health: stunnel listeners should be bound and TLS handshakes succeeding."

Remediation

1. Patch immediately. Update to stunnel 5.80 on all Fedora 44 systems via dnf update stunnel (advisory FEDORA-2026-67c2201ad8). Reference: https://linuxsecurity.com/advisories/fedora/fedora-44-stunnel-2026-67c2201ad8
2. Don't forget containers and golden images. Any container image built FROM fedora:44 or any AMI/VMDK with stunnel baked in inherits the flaw. Rebuild and redeploy; package patching a live container is not remediation.
3. Restart the daemon after patching. RPM updates do not always restart long-running daemons — a patched binary on disk with a vulnerable process in memory leaves you exposed. Confirm the running process maps to the new binary.
4. Eliminate SOCKS chaining unless architecturally required. The SOCKS bypass facet only matters if stunnel traverses a SOCKS proxy. If your configs do not require it, ensure no socks directives exist. If they do require it, validate that the SOCKS hop is a host you control, on a segment you control, with its own authentication enforced.
5. Enforce client verification while you are there. The 5.80 update strengthens client certificate verification. Where stunnel fronts sensitive services, require mutual TLS (verify = 3 or 4 with proper CAFile/CRL configuration) so that even a negotiation-path weakness does not translate into anonymous access.
6. Monitor for the crash primitive. Until patching completes fleet-wide, alert on stunnel segfaults and unexpected restarts (rules above). A TLS terminator that keeps dying is either broken or being probed — both deserve a ticket.
7. Watch for KEV addition and PoC publication. CVE-2026-70368 is not currently in CISA KEV and has no public exploit. Subscribe to the Fedora announcement list and stunnel upstream so your SLAs re-trigger if that changes.

Bottom Line

Stunnel is a quiet workhorse — which is exactly why it gets forgotten in asset inventories and patch SLAs. CVE-2026-70368 hits the two things a TLS proxy must never get wrong: how it negotiates the path to its destination, and how it handles key material. Patch to 5.80, restart the daemons, audit for SOCKS chaining, and put crash telemetry on your dashboards. The window between "no known exploitation" and "proof of concept on GitHub" is where good vulnerability management programs earn their keep.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub