[slackware-security] stunnel

New stunnel packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/stunnel-5.80-i586-1slack15.0.txz: Upgraded. This update fixes security issues: Fixed an out-of-bounds memory access triggered by...

GHSA-WVP2-4QQP-4H3R Ghost: Private IP filtering bypass to make server-side requests to internal services

Impact When making an external request, it is possible to bypass the IP filter that ensures the request isn't going to an internal service using an IPv6 literal which maps to a private IPv4 address. Vulnerable versions This vulnerability is present in Ghost from v6.0.9 up to v6.21.0. Patches...

EUVD-2026-39025

Ghost: Private IP filtering bypass to make server-side requests to internal services...

CVE-2026-18812 H3C NX15 esps esps.ipv6.wan command injection

A flaw has been found in H3C NX15 V100R017. The impacted element is the function esps.ipv6.wan of the file /api/esps. Executing a manipulation of the argument workMode can lead to command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The...

EUVD-2026-52898

A flaw has been found in H3C NX15 V100R017. The impacted element is the function esps.ipv6.wan of the file /api/esps. Executing a manipulation of the argument workMode can lead to command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The...

CVE-2026-18812 H3C NX15 esps esps.ipv6.wan command injection

A flaw has been found in H3C NX15 V100R017. The impacted element is the function esps.ipv6.wan of the file /api/esps. Executing a manipulation of the argument workMode can lead to command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The...

CVE-2026-18812

The CVE-2026-18812 entry concerns H3C NX15 V100R017. The affected component is esps.ipv6.wan in the /api/esps path. The root cause is manipulation of the argument workMode, enabling command injection. Exploitation is possible remotely, with a published exploit. The CVE documents do not provide re...

CVE-2026-70485

CVE-2026-70485 – Open WebUI : Affected versions 0.9.0 through 0.11.0 of the Open WebUI self-hosted AI platform check whether a user-provided URL is globally routable by applying ipaddress.is_global to the literal IPv6 address, without considering embedded IPv4 in transition encodings. In NAT64 de...

EUVD-2026-52890

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, Open WebUI checked whether a user-supplied URL destination was globally routable by applying ipaddress.isglobal to the literal IPv6 address without examining IPv4 addresses embedded in...

Server-Side Request Forgery (SSRF)

Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Server-Side Request Forgery SSRF in the isDeniedIP function, which fails to properly normalize IPv4-mapped IPv6 addresses before checking them against the deny list. An attacker can access internal services...

GHSA-C6XH-WV4J-PPV5 Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses

Summary Flowise's HTTP security module httpSecurity.ts fails to normalize IPv4-mapped IPv6 addresses e.g., ::ffff:127.0.0.1, ::ffff:169.254.169.254 before checking them against the deny list. Due to an ipaddr.js kind mismatch ipv6 vs ipv4, all IPv4 CIDR deny rules are silently skipped for...

CVE-2026-69257 Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise's HTTP security module httpSecurity.ts did not normalize IPv4-mapped IPv6 addresses such as ::ffff:127.0.0.1 and ::ffff:169.254.169.254 before checking them against the deny list...

AZL-94577 CVE-2026-70367 affecting package stunnel 5.74-1

A Server-Side Request Forgery SSRF bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses e.g., “::ffff:127.0.0.1” or unspecified addresses "0.0.0.0", "::"...

netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation

A flaw was found in netty-handler, a component of the Netty network application framework. A remote attacker can exploit an incorrect masking operation in the IpSubnetFilterRule.compareTo function to bypass configured IPv6 subnet rules. This allows valid public IP addresses to circumvent intended...

EUVD-2026-52687

A Server-Side Request Forgery SSRF bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses e.g., “::ffff:127.0.0.1” or unspecified addresses "0.0.0.0", "::"...

CVE-2026-70367

A Server-Side Request Forgery SSRF bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses e.g., “::ffff:127.0.0.1” or unspecified addresses "0.0.0.0", "::"...

CVE-2026-70367

A Server-Side Request Forgery SSRF bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses e.g., “::ffff:127.0.0.1” or unspecified addresses "0.0.0.0", "::"...

ROS-20260804-73-0037

The vulnerability of the netifrx function in the net/ipv6/ip6input.c file of the Linux kernel is related to the assignment of a null pointer. Exploiting this vulnerability could allow an attacker to cause a service failure...

MiracleLinux 9 : kernel-5.14.0-687.19.1.el9_8 (AXSA:2026-1437:58)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1437:58 advisory. kernel: drm/amd/display: Do not skip unrelated mode changes in DSC validation CVE-2026-31488 kernel: ipv6: icmp: clear skb2-cb in...

PT-2026-67712

Name of the Vulnerable Software and Affected Versions stunnel versions prior to 5.80 Description A Server-Side Request Forgery SSRF bypass occurs when the software is configured in SOCKS proxy mode. This issue allows a client to circumvent localhost restrictions by utilizing unspecified addresses...