CVE-2026-104074
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote unauthenticated attackers to leak stack memory contents by sending a TURN Allocate request without credentials. The stun_init_error_response_common_str() function fails to zero-initialize the avalue buffer before computing its length and copying leaked stack bytes into the ERROR-CODE reason phrase.
Risk Assessment
Disclosure of pointer fragments can weaken ASLR and enable precise version fingerprinting, facilitating further attacks. The vulnerability is easily exploitable remotely without authentication.
Recommendation
Update Coturn to a version containing the fix. If updating is not possible, consider restricting access to the TURN service from untrusted networks.
Other vulnerabilities in Coturn
See all- CVE-2026-68555Medium
Coturn version 4.15.0 has a vulnerability that allows an authenticated TURN user to repeatedly resume allocations from fresh UDP 5-tuples without completing a handoff when --mobility is enabled. This leads to unbounded server-side sessions and process memory exhaustion even with --user-quota=1 configured.
- CVE-2026-68554Low
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an on-path attacker can append attributes after MESSAGE-INTEGRITY to an authenticated STUN request on plain UDP or TCP, adjust the STUN header length, and recompute the unkeyed FINGERPRINT while the original HMAC remains valid because it covers only the message prefix. Server-side parsing in src/server/ns_turn_server.c continues past MESSAGE-INTEGRITY through handle_turn_allocate(), handle_turn_create_permission(), handle_turn_refresh(), and handle_turn_command(), allowing trailing LIFETIME, XOR-PEER-ADDRESS, or ORIGIN attributes to override allocation lifetime, inject a permission, or bypass the origin check. TLS and DTLS deployments prevent this in-transit modification. This issue is fixed in version 4.15.0.
- CVE-2026-68553High
In Coturn before 4.13.0, an authenticated TURN user can place printf-style format specifiers in STUN USERNAME or REALM attributes, which pass is_secure_string() validation and are embedded into Redis keys. send_message_to_redis() passes the attacker-controlled key as the format argument to redisAsyncCommand(), causing reads past the va_list. Exploitation can crash the coturn process or disclose stack memory into Redis.
- CVE-2026-68552Medium
Coturn before version 4.15.0 has a vulnerability where an unauthenticated client can send a STUN message over TCP/TLS with a body-length field from 65520 through 65532, causing the len variable in stun_get_message_len_str() to wrap. This leads to desynchronization of the stream parser and drops the attacking client's connection, but does not affect other clients or the server process.
- CVE-2026-73216Medium
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, shutdown_client_connection() in src/server/ns_turn_server.c prematurely calls dec_quota() and releases bandwidth accounting during the first-stage close of a mobility-enabled allocation while preserving the allocation, relay socket, session, and mobility ticket, allowing an authenticated client to bypass --user-quota and --total-quota and exhaust relay ports. This issue is fixed in version 4.17.0.
- CVE-2026-73215High
Coturn before version 4.17.0 has a vulnerability in turnports_allocate_even() that marks the unused odd sibling port as TPS_TAKEN_ODD for an EVEN-PORT Allocate request with reservation bit R=0 even though no RTCP socket will release it. An authenticated client can permanently exhaust the relay port pool, causing subsequent allocations to fail with STUN error 508.
- CVE-2026-73214High
Coturn before version 4.16.0 has a vulnerability in dtls_server_input_handler() and create_new_connected_udp_socket() that retain OpenSSL dtls1_reassemble_fragment() state for a 35-byte fragmented ClientHello declaring a 650,000-byte handshake before cookie validation. An unauthenticated remote sender can exhaust memory without TURN credentials, a completed handshake, a valid cookie, or source spoofing.
- CVE-2026-73213Medium
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, addr_less_eq() in src/client/ns_turn_ioaddr.c uses a component-wise comparison for native IPv6 min-max intervals in ioa_addr_in_range(), allowing an authenticated TURN client to relay to an IPv6 peer that is numerically within a configured non-prefix-aligned denied-peer-ip range but is classified as outside it. This issue is fixed in version 4.16.0.
- CVE-2026-73212Medium
Coturn before version 4.13.1 has a vulnerability in good_peer_addr() that does not canonicalize IPv4-compatible, 6to4, and NAT64 (64:ff9b::/96) address forms. This allows an authenticated RFC 6062 TCP CONNECT relay client to bypass an IPv4 denied-peer-ip range when the Coturn host has a useful translation route.
- CVE-2026-65981High
Coturn versions before 4.15.0 with --mobility enabled contain a vulnerability that allows an authenticated attacker to hijack another user's REFRESH session. An attacker who obtains a victim's MOBILITY-TICKET can receive and inject relayed traffic and consume the victim's quota. The issue is due to incorrect identity verification in the resume branch.
Original NVD description (English source)
Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote unauthenticated attackers to leak stack memory contents by sending a TURN Allocate request without credentials. Attackers can exploit the stun_init_error_response_common_str() function in src/client/ns_turn_msg.c, which fails to zero-initialize the avalue buffer before computing its length with strlen() and copying leaked stack bytes into the ERROR-CODE reason phrase, exposing pointer fragments that weaken ASLR and enable precise version fingerprinting.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS