Log in Start free

Vulnerability · Published Oct 7, 2026 · Assigned by VulnCheck

CVE-2026-104074Coturn 4.10.0 Uninitialized Stack Memory Disclosure via ERROR-CODE

Medium 5.3

In plain English

A medium-severity security flaw in coturn from coturn. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.3%top 75.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote unauthenticated attackers to leak stack memory contents by sending a TURN Allocate request without credentials. Attackers can exploit the stun_init_error_response_common_str() function in src/client/ns_turn_msg.c, which fails to zero-initialize the avalue buffer before computing its length with strlen() and copying leaked stack bytes into the ERROR-CODE reason phrase, exposing pointer fragments that weaken ASLR and enable precise version fingerprinting.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12coturnno fix listedDEBIAN-CVE-2026-104074
Debian:13coturnno fix listedDEBIAN-CVE-2026-104074
Debian:14coturn4.12.0-1DEBIAN-CVE-2026-104074
Ubuntu:22.04:LTScoturnno fix listedUBUNTU-CVE-2026-104074
Ubuntu:24.04:LTScoturnno fix listedUBUNTU-CVE-2026-104074
Ubuntu:26.04:LTScoturnno fix listedUBUNTU-CVE-2026-104074

Affected products (as reported)

VendorProductVersions
coturn coturn 4.10.0 – before 4.11.0

Weakness: CWE-908 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References