CVE-2008-2420: Stunnel

Medium severity, CVSS 6.8. EPSS: 1.4% chance of exploitation in the next 30 days.

The OCSP functionality in stunnel before 4.24 does not properly search certificate revocation lists (CRL), which allows remote attackers to bypass intended access restrictions by using revoked certificates.

Affected products

• Stunnel Stunnel: version 3.4a only; version 3.5 only; version 3.6 only; version 3.7 only; version 3.8 only; version 3.8p1 only; …

Published 2008-05-23. Last modified 2026-06-16.