CVE-2014-0016

no score yetEPSS 2.2%

stunnel stunnel: no CVSS score yet. EPSS 2.2% chance of exploitation in the next 30 days.

stunnel before 5.00, when using fork threading, does not properly update the state of the OpenSSL pseudo-random number generator (PRNG), which causes subsequent children with the same process ID to use the same entropy pool and allows remote attackers to obtain private keys for EC (ECDSA) or DSA certificates.

EPSS: 2.2% chance of exploitation in the next 30 days; higher than 82% of CVEs (scores of 2026-10-31)
CWE: CWE-332
Published: 2014-03-24
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

stunnel:stunnel

References

http://www.openwall.com/lists/oss-security/2014/03/05/1
http://www.securityfocus.com/bid/65964
https://bugzilla.redhat.com/attachment.cgi?id=870826&action=diff
https://bugzilla.redhat.com/show_bug.cgi?id=1072180
https://www.stunnel.org/sdf_ChangeLog.html

Check your stack JSON