- stunnel-announce - stunnel.org

stunnel 5.82 released
by Michał Trojnara 17 Sep '26

17 Sep '26

Dear Users, I have released version 5.82 of stunnel. ### Version 5.82, 2026.09.17, urgency: MEDIUM * Bugfixes - Fixed premature connection closure on macOS when the peer half-closed the plaintext connection while data still needed to be forwarded. * Features - Build compatibility with LibreSSL 4.3.2 (thanks to Masahito Yamaga). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 8e7438ccd6b3a2ab05182d0846e112a56a7f557ecdee40de07bf67820008bef7 stunnel-5.82.tar.gz 722c1ad626919af2b0034666b4d19cc4795e925c32f60e8f3c59af4fb3ad2dfc stunnel-5.82-win64-installer.exe e5bdb7fefaac57afebd8276165b2c69b92b4e717d0a00302d2431541936cb60a stunnel-5.82-android.zip Best regards, Mike

1 0

stunnel 5.81 released
by Michał Trojnara 16 Sep '26

16 Sep '26

Dear Users, I have released version 5.81 of stunnel. ### Version 5.81, 2026.09.16, urgency: HIGH * Security bugfixes - OpenSSL DLLs updated to version 3.5.8. - Fixed truncation and out-of-bounds reads when inheriting binary session ticket keys containing null bytes (thanks to Jose A. Diaz). - Prevented OCSP stapling response failures from terminating the daemon (thanks to Jose A. Diaz). * Bugfixes - Avoided spurious sysconf error messages after successful descriptor-limit queries on platforms where a successful call may change errno. - Fixed a potential crash when parsing empty ASCII PSK secrets (thanks to Jose A. Diaz). - Fixed a memory leak after DTLS listener poll errors and timeouts (thanks to Jose A. Diaz). - Fixed memory leaks during NTLM HTTP proxy negotiation (thanks to Jose A. Diaz). - Fixed early startup logging before thread lock initialization (thanks to Jose A. Diaz). - Rejected excessively nested configuration includes instead of consuming the process stack recursively. * Features - Improved TLS and DTLS shutdown diagnostics. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 1d1b48fa26a06a5a035ca5ddc7377c75d5d78ad6f3b4886352a84818c854f932 stunnel-5.81.tar.gz ec16df6313dced7c84f20dbb9c677847d0a5219bdd35ab40cde18c135abd0411 stunnel-5.81-win64-installer.exe 5eec038e3a9c44d135942c2486ffa5156c02cfcf31bb5b7a65c6134c459a49f9 stunnel-5.81-android.zip Best regards, Mike

1 0

stunnel 5.80 released
by Michał Trojnara 04 Aug '26

04 Aug '26

Dear Users, I have released version 5.80 of stunnel. This is a security bugfix release. Details are available on: * https://www.stunnel.org/CVE-2026-70368.html * https://www.stunnel.org/CVE-2026-70367.html ### Version 5.80, 2026.08.04, urgency: HIGH * Security bugfixes - CVE-2026-70368: Fixed an out-of-bounds memory access triggered by logging attacker-controlled protocol messages longer than 1,024 bytes (thanks to AISLE Research and Clemens Lang). - CVE-2026-70367: Fixed a SOCKS server mode bypass of the localhost destination filter using alternate local-address encodings and interface-scoped IPv6 destinations (thanks to AISLE Research and Clemens Lang). - Restricted Windows GUI/service control pipes to local clients. * Bugfixes - Fixed concurrent DTLS handshakes from clients sharing an IP address. - Fixed version reporting in builds from source. - Rejected stream-oriented protocol negotiation with the UDP transport during configuration validation. * Features - Added the "CRLcheckChain" service-level option for opt-in full-chain CRL verification. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 6d0841d48de07cbbaf4a055919065bf7bb5ebc63cc15c97a2c76caa2bf285513 stunnel-5.80.tar.gz 25947bd268e2e670e1c7f915cefd54585aaa440d09eb20c6109cdbeaf3140bc4 stunnel-5.80-win64-installer.exe 15a36d8641bcf885f13ce0ee858d1f07bf4798824093e54fd00eeeb526dcc5ab stunnel-5.80-android.zip Best regards, Mike

1 0

stunnel 5.79 released
by Michał Trojnara 29 Jun '26

29 Jun '26

Dear Users, I have released version 5.79 of stunnel. ### Version 5.79, 2026.06.29, urgency: MEDIUM * Security bugfixes - OpenSSL DLLs updated to version 3.5.7. * Bugfixes - Fixed a TCP stream truncation (thanks to Solomon Jacobs). - Fixed a transfer() loop (thanks to Solomon Jacobs). - Fixed log reopening logs without a configured log file. - Fixed some logged values (thanks to Jose Alf.). - Fixed some error handling and cleanup issues (thanks to Jose Alf.). - Fixed OpenSSL applink detection and MSYS2 MinGW builds. * Features - Added the new 'transport' service-level option to choose between TLS over TCP and DTLS over UDP. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 8ea0de6e5ea76f38ea987fa831c7fd47f7a1f1e7dd465fd6fa8622edf30d3a45 stunnel-5.79.tar.gz 3d946e9759d5a6c6fc5aadb6b56e7de1a81d210ad028235340616e471afeb6f6 stunnel-5.79-win64-installer.exe 6257efc6c53af66541d6138e67d9377e050c13ad41880250dd43346c54127892 stunnel-5.79-android.zip Best regards, Mike

1 0

stunnel 5.78 released
by Michał Trojnara 10 Apr '26

10 Apr '26

Dear Users, I have released version 5.78 of stunnel. ### Version 5.78, 2026.04.09, urgency: MEDIUM * Security bugfixes - OpenSSL DLLs updated to version 3.5.6. * Bugfixes - Fixed WIN32 transfer() loop errors with OOB TCP. - Fixed a memory leak introduced in version 5.73. - Build fix for systems without timegm() (thanks to Jose A. Diaz and Shubham Gupta). - Fixed a startup crash when both global (default) and service-level lists of values are configured for an option. * Features - Support for zstd and brotli compression with OpenSSL 3.2 and TLS 1.2 or older. - WIN32 OpenSSL build with zlib and zstd support. - Support for new "options" parameter values. - Less bloated errors on an invalid configuration file. - Documentation updated from Pod to Pandoc Markdown. - Removed support for OpenSSL versions older than 0.9.8. The final update for the OpenSSL 0.9.7 branch (0.9.7m) was issed on 23 Feb 2007. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 8727e53bb8b7528f850327a2a149158422c02183bc120d1d733cc65b1e2c349d stunnel-5.78.tar.gz 541700197ce2e03dd86b343d9cbf6434359cca9f44e6927fde1d2c76c355c3e6 stunnel-5.78-win64-installer.exe b585d0828165d2e317f3956f2657fa6fb265b34b3ff49181bf561acd8eea2500 stunnel-5.78-android.zip Best regards, Mike

1 1

List server change
by Michał Trojnara 28 Feb '26

28 Feb '26

Dear users, The list address has been changed from stunnel-announce(a)stunnel.org to stunnel-announce(a)lists.stunnel.org. Please let me know if you experience any issues caused by this change. Best regards, Mike

1 0

stunnel 5.77 released
by Michał Trojnara 17 Feb '26

17 Feb '26

Dear Users, I have released version 5.77 of stunnel. ### Version 5.77, 2026.02.17, urgency: MEDIUM * Security bugfixes - OpenSSL DLLs updated to version 3.5.5. * Bugfixes - Avoid attempting to fetch OCSP stapling for PSK-only configuration sections. * Features - Merged applicable patches from Fedora and Debian: - Use SOURCE_DATE_EPOCH for reproducible builds. - Skip the OpenSSL version check when AUTOPKGTEST_TMP is set. - Enable PrivateTmp in the stunnel.service template. - Clarify the manual page for the "curves" option. - Log client IP addresses on TLS errors. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: ec026f4fae4e0d25b940cc7a9451d925e359e7fd59e9edad20baea66ce45f263 stunnel-5.77.tar.gz 59ba0c5330de85ef474164b40cc559b2eb4e2b8d788c48b564e2257efa236384 stunnel-5.77-win64-installer.exe 718431a1d3c889806b61d6f082bbfaaa29529ce422d8115ad2211574dfb89ec1 stunnel-5.77-android.zip Best regards, Mike

1 0

stunnel 5.76 released
by Michał Trojnara 18 Oct '25

18 Oct '25

Dear Users, I have released version 5.76 of stunnel. ### Version 5.76, 2025.10.18, urgency: MEDIUM * Security bugfixes - OpenSSL DLLs updated to version 3.5.4. - Service-level multivalued options now override (rather than append to) global defaults, preventing unintended configurations. * Bugfixes - Fixed enabling/disabling of the default fips=yes property. - Missing OCSP stapling is no longer logged as an error. - Fixed a crash when a PIN was required due to the PKCS#11 CKA_ALWAYS_AUTHENTICATE attribute. * Features - Quantum-resistant hybrid key agreement X25519+ML-KEM-768 (X25519MLKEM768) used by default with OpenSSL 3.5+ and TLS 1.3. - Multiple cert sources are supported, allowing a certificate to be fetched from a provider while loading the chain from a file. - Android build switched to a 16 KB page size. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: cda37eb4d0fb1e129718ed27ad77b5735e899394ce040bb2be28bbb937fd79e1 stunnel-5.76.tar.gz d93c7c01366d38ebd27689d606e45197ba8e2e2a32d1a186a81d2b01186bfb56 stunnel-5.76-win64-installer.exe f081281c92f6dc245e23d57930f3963d0155a9fc4a707b7414c941e8e60a1957 stunnel-5.76-android.zip Best regards, Mike

1 0

stunnel 5.75 released
by Michał Trojnara 26 May '25

26 May '25

Dear Users, I have released version 5.75 of stunnel. ### Version 5.75, 2025.05.26, urgency: MEDIUM * Security bugfixes - OpenSSL DLLs updated to version 3.4.1. - OpenSSL FIPS Provider updated to version 3.1.2. * Bugfixes - Fixed infinite loop triggered by OCSP URL parsing errors (thx to Richard Könning for reporting). - Fixed OPENSSL_NO_OCSP build issues (thx to Dmitry Mostovoy for reporting). - Fixed default curve selection in FIPS mode with OpenSSL 3.4+. - Fixed tests with modern Python versions. - Fixed tests with multiple OpenSSL versions installed. * Features - Added provider URI support for "cert" and "key" options. - Added new "CAstore" service-level option (OpenSSL 3.0+). - Added "provider" (OpenSSL 3.0+), "providerParameter" (OpenSSL 3.5+), and "setEnv" global options. - Key file/URI path added to passphrase prompt on Unix. - PKCS#11 provider installed on Windows. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 0c1ef0ed85240974dccb94fe74fb92d6383474c7c0d10e8796d1f781a3ba5683 stunnel-5.75.tar.gz 18ec3b83bda9143c79479ecdc1e3ecf515eeb8a8b11e6ea3a6856cd77399317d stunnel-5.75-win64-installer.exe d1a04ec51840d8cbf5fb6d897d2eb999af573b5b66268fdec109cddaff2acfb7 stunnel-5.75-android.zip Best regards, Mike

1 0

stunnel 5.74 released
by Michał Trojnara 13 Dec '24

13 Dec '24

Dear Users, I have released version 5.74 of stunnel. ### Version 5.74, 2024.12.13, urgency: HIGH * Bugfixes - Fixed a stapling cache deallocation crash. - Fixed "redirect" with protocol negotiation. * Features - "protocolHost" support for "socks" protocol clients. - More detailed logs in OpenSSL 3.0 or later. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 9bef235ab5d24a2a8dff6485dfd782ed235f4407e9bc8716deb383fc80cd6230 stunnel-5.74.tar.gz 8ce19cc782a64b0cacf32356249265ed16b3888e3578454853f5497726778d76 stunnel-5.74-win64-installer.exe 68c3395c1bebcc8b4eee2c7f58190aa2fe39b835dd7a4cce5ad37d5dfc1c5542 stunnel-5.74-android.zip Best regards, Mike

1 0