CVE-2026-68555

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an on-path attacker can append attributes after MESSAGE-INTEGRITY to an authenticated STUN request on plain UDP or TCP, adjust the STUN header length, and recompute the unkeyed FINGERPRINT while the original HMAC remains valid because it covers only the message prefix. Server-side parsing in src/server/ns_turn_server.c continues past MESSAGE-INTEGRITY through handle_turn_allocate(), handle_turn_create_permission(), handle_turn_refresh(), and handle_turn_command(), allowing trailing LIFETIME, XOR-PEER-ADDRESS, or ORIGIN attributes to override allocation lifetime, inject a permission, or bypass the origin check. TLS and DTLS deployments prevent this in-transit modification. This issue is fixed in version 4.15.0.

In Coturn before 4.13.0, an authenticated TURN user can place printf-style format specifiers in STUN USERNAME or REALM attributes, which pass is_secure_string() validation and are embedded into Redis keys. send_message_to_redis() passes the attacker-controlled key as the format argument to redisAsyncCommand(), causing reads past the va_list. Exploitation can crash the coturn process or disclose stack memory into Redis.

Coturn before version 4.15.0 has a vulnerability where an unauthenticated client can send a STUN message over TCP/TLS with a body-length field from 65520 through 65532, causing the len variable in stun_get_message_len_str() to wrap. This leads to desynchronization of the stream parser and drops the attacking client's connection, but does not affect other clients or the server process.

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, shutdown_client_connection() in src/server/ns_turn_server.c prematurely calls dec_quota() and releases bandwidth accounting during the first-stage close of a mobility-enabled allocation while preserving the allocation, relay socket, session, and mobility ticket, allowing an authenticated client to bypass --user-quota and --total-quota and exhaust relay ports. This issue is fixed in version 4.17.0.

Coturn before version 4.17.0 has a vulnerability in turnports_allocate_even() that marks the unused odd sibling port as TPS_TAKEN_ODD for an EVEN-PORT Allocate request with reservation bit R=0 even though no RTCP socket will release it. An authenticated client can permanently exhaust the relay port pool, causing subsequent allocations to fail with STUN error 508.

Coturn before version 4.16.0 has a vulnerability in dtls_server_input_handler() and create_new_connected_udp_socket() that retain OpenSSL dtls1_reassemble_fragment() state for a 35-byte fragmented ClientHello declaring a 650,000-byte handshake before cookie validation. An unauthenticated remote sender can exhaust memory without TURN credentials, a completed handshake, a valid cookie, or source spoofing.

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, addr_less_eq() in src/client/ns_turn_ioaddr.c uses a component-wise comparison for native IPv6 min-max intervals in ioa_addr_in_range(), allowing an authenticated TURN client to relay to an IPv6 peer that is numerically within a configured non-prefix-aligned denied-peer-ip range but is classified as outside it. This issue is fixed in version 4.16.0.

Coturn before version 4.13.1 has a vulnerability in good_peer_addr() that does not canonicalize IPv4-compatible, 6to4, and NAT64 (64:ff9b::/96) address forms. This allows an authenticated RFC 6062 TCP CONNECT relay client to bypass an IPv4 denied-peer-ip range when the Coturn host has a useful translation route.

Coturn versions before 4.15.0 with --mobility enabled contain a vulnerability that allows an authenticated attacker to hijack another user's REFRESH session. An attacker who obtains a victim's MOBILITY-TICKET can receive and inject relayed traffic and consume the victim's quota. The issue is due to incorrect identity verification in the resume branch.

Coturn from 4.5.2 through 4.14.0, when started with --acme-redirect and a plaintext-TCP listener, allows an unauthenticated client to send an HTTP GET request and receive a 301 response leaking up to ~870 bytes of adjacent process heap memory. The leaked region may contain other clients' TURN credentials, OAuth tokens, or relayed payloads.