stunnel 5.80 released
'Michał Trojnara' via openssl-users <[email protected]> Tue, 4 Aug 2026 16:12:36 +0200
| Newsgroups | gmane.comp.encryption.openssl.user,gmane.network.stunnel.user |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format.
--------------7ERQfcQu8KcyXVywu4aTXfXc
Content-Type: text/plain; charset="UTF-8"; format=flowed
Content-Transfer-Encoding: quoted-printable
Dear Users,
I have released version 5.80 of stunnel.
This is a security bugfix release.=C2=A0 Details are available on:
* https://www.stunnel.org/CVE-2026-70368.html
* https://www.stunnel.org/CVE-2026-70367.html
### Version 5.80, 2026.08.04, urgency: HIGH
* Security bugfixes
=C2=A0 - CVE-2026-70368: Fixed an out-of-bounds memory access triggered by
=C2=A0 =C2=A0 logging attacker-controlled protocol messages longer than 1,=
024 bytes
=C2=A0 =C2=A0 (thanks to AISLE Research and Clemens Lang).
=C2=A0 - CVE-2026-70367: Fixed a SOCKS server mode bypass of the localhost
=C2=A0 =C2=A0 destination filter using alternate local-address encodings a=
nd
=C2=A0 =C2=A0 interface-scoped IPv6 destinations (thanks to AISLE Research=
and
=C2=A0 =C2=A0 Clemens Lang).
=C2=A0 - Restricted Windows GUI/service control pipes to local clients.
* Bugfixes
=C2=A0 - Fixed concurrent DTLS handshakes from clients sharing an IP addre=
ss.
=C2=A0 - Fixed version reporting in builds from source.
=C2=A0 - Rejected stream-oriented protocol negotiation with the UDP transp=
ort
=C2=A0 =C2=A0 during configuration validation.
* Features
=C2=A0 - Added the "CRLcheckChain" service-level option for opt-in
=C2=A0 =C2=A0 full-chain CRL verification.
Home page: https://www.stunnel.org/
Download: https://www.stunnel.org/downloads.html
SHA-256 hashes:
6d0841d48de07cbbaf4a055919065bf7bb5ebc63cc15c97a2c76caa2bf285513=20
=C2=A0stunnel-5.80.tar.gz
25947bd268e2e670e1c7f915cefd54585aaa440d09eb20c6109cdbeaf3140bc4=20
=C2=A0stunnel-5.80-win64-installer.exe
15a36d8641bcf885f13ce0ee858d1f07bf4798824093e54fd00eeeb526dcc5ab=20
=C2=A0stunnel-5.80-android.zip
Best regards,
=C2=A0=C2=A0=C2=A0 Mike
--=20
You received this message because you are subscribed to the Google Groups "=
openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msg=
id/openssl-users/a63702d3-60db-409f-9444-c543b79f8cd7%40stunnel.org.
--------------7ERQfcQu8KcyXVywu4aTXfXc
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE html>
<html>
<head>
<meta http-equiv=3D"content-type" content=3D"text/html; charset=3DUTF-8=
">
</head>
<body text=3D"#000000" bgcolor=3D"#FFFFFF">
<p>Dear Users,</p>
<p>I have released version 5.80 of stunnel.</p>
<p>This is a security bugfix release.=C2=A0 Details are available on:</=
p>
<ul>
<li><a class=3D"moz-txt-link-freetext" href=3D"https://www.stunnel.or=
g/CVE-2026-70368.html">https://www.stunnel.org/CVE-2026-70368.html</a></li>
<li><a class=3D"moz-txt-link-freetext" href=3D"https://www.stunnel.or=
g/CVE-2026-70367.html">https://www.stunnel.org/CVE-2026-70367.html</a></li>
</ul>
### Version 5.80, 2026.08.04, urgency: HIGH<br>
* Security bugfixes<br>
=C2=A0 - CVE-2026-70368: Fixed an out-of-bounds memory access triggered
by<br>
=C2=A0 =C2=A0 logging attacker-controlled protocol messages longer than=
1,024
bytes<br>
=C2=A0 =C2=A0 (thanks to AISLE Research and Clemens Lang).<br>
=C2=A0 - CVE-2026-70367: Fixed a SOCKS server mode bypass of the
localhost<br>
=C2=A0 =C2=A0 destination filter using alternate local-address encoding=
s and<br>
=C2=A0 =C2=A0 interface-scoped IPv6 destinations (thanks to AISLE Resea=
rch and<br>
=C2=A0 =C2=A0 Clemens Lang).<br>
=C2=A0 - Restricted Windows GUI/service control pipes to local clients.=
<br>
* Bugfixes<br>
=C2=A0 - Fixed concurrent DTLS handshakes from clients sharing an IP
address.<br>
=C2=A0 - Fixed version reporting in builds from source.<br>
=C2=A0 - Rejected stream-oriented protocol negotiation with the UDP
transport<br>
=C2=A0 =C2=A0 during configuration validation.<br>
* Features<br>
=C2=A0 - Added the "CRLcheckChain" service-level option for opt-in<br>
=C2=A0 =C2=A0 full-chain CRL verification.
<p>Home page: <a class=3D"moz-txt-link-freetext"
href=3D"https://www.stunnel.org/" moz-do-not-send=3D"true">https://=
www.stunnel.org/</a></p>
<p>Download: <a class=3D"moz-txt-link-freetext"
href=3D"https://www.stunnel.org/downloads.html"
moz-do-not-send=3D"true">https://www.stunnel.org/downloads.html</a>=
</p>
SHA-256 hashes:<br>
<span style=3D"font-family:monospace"><span
style=3D"color:#000000;background-color:#ffffff;">6d0841d48de07cbba=
f4a055919065bf7bb5ebc63cc15c97a2c76caa2bf285513
=C2=A0stunnel-5.80.tar.gz</span><span
style=3D"color:#000000;background-color:#ffffff;">
</span><br>
<span style=3D"color:#000000;background-color:#ffffff;">25947bd268e2e=
670e1c7f915cefd54585aaa440d09eb20c6109cdbeaf3140bc4
=C2=A0stunnel-5.80-win64-installer.exe</span><span
style=3D"color:#000000;background-color:#ffffff;">
</span><br>
<span style=3D"color:#000000;background-color:#ffffff;">15a36d8641bcf=
885f13ce0ee858d1f07bf4798824093e54fd00eeeb526dcc5ab
=C2=A0stunnel-5.80-android.zip</span></span><font face=3D"monospace=
"><br>
</font>
<p>Best regards,<br>
=C2=A0=C2=A0=C2=A0 Mike</p>
</body>
</html>
<p></p>
-- <br />
You received this message because you are subscribed to the Google Groups &=
quot;openssl-users" group.<br />
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to <a href=3D"mailto:openssl-users+unsubscribe-MCmKBN63+BlAfugRpC6u6w@public.gmane.org">openssl-us=
[email protected]</a>.<br />
To view this discussion visit <a href=3D"https://groups.google.com/a/openss=
l.org/d/msgid/openssl-users/a63702d3-60db-409f-9444-c543b79f8cd7%40stunnel.=
org?utm_medium=3Demail&utm_source=3Dfooter">https://groups.google.com/a/ope=
nssl.org/d/msgid/openssl-users/a63702d3-60db-409f-9444-c543b79f8cd7%40stunn=
el.org</a>.<br />
--------------7ERQfcQu8KcyXVywu4aTXfXc--