Log in Start free

coturn

Products

ProductCVEsExploitedLatest
coturn22–Oct 7, 2026

Exploited and recent CVEs

  • CVE-2026-104074 Medium 5.3 Coturn 4.10.0 Uninitialized Stack Memory Disclosure via ERROR-CODE 0.3%
  • CVE-2026-68555 Medium 6.5 coturn: Chained mobility resumes allow authenticated remote memory exhaustion 0.5%
  • CVE-2026-68552 Medium 5.3 Coturn: uint16_t truncation overflow in STUN message length causes TCP stream framing bypass 0.5%
  • CVE-2026-68554 Low 2.3 Coturn: STUN attributes after MESSAGE-INTEGRITY are processed, letting on-path attackers modify authenticated TURN requests 0.2%
  • CVE-2026-68553 High 7.1 Coturn: Format String Injection via TURN USERNAME/REALM into hiredis Redis Command 0.5%
  • CVE-2026-73216 Medium 6.5 coturn: mobility disconnects bypass allocation quotas and exhaust relay capacity 0.6%
  • CVE-2026-73215 High 7.1 The coturn server can end in a state where it does not accept more requests with "even-port" enabled. 0.5%
  • CVE-2026-73214 High 8.2 coturn allocates a full per-peer SSL/session before verifying the DTLS cookie, enabling source-spoofing/botnet state-exhaustion DoS 0.6%
  • CVE-2026-73213 Medium 5.8 Coturn: `addr_less_eq()` does a component-wise IPv6 comparison instead of a lexicographic one, letting an authenticated TURN client bypass `denied-peer-ip`/`allowed-peer-ip` IPv6 ranges (TURN-specific SSRF) 0.4%
  • CVE-2026-73212 Medium 5.8 coturn peer-IP ACL canonicalization & scope bypass on the RFC 6062 TCP CONNECT relay path → internal-network SSRF and proven internal root RCE 0.5%
  • CVE-2026-65981 High 7.1 Coturn: MOBILITY-TICKET session-resume authorization bypass allows cross-user TURN allocation takeover 0.4%
  • CVE-2026-62959 High 8.2 Coturn: Pre-authentication heap memory disclosure in ACME redirect (`try_acme_redirect`) 0.5%
  • CVE-2026-53450 High 7.4 Coturn: IPv4-mapped 127.0.0.1 bypasses default loopback peer protection 0.3%
  • CVE-2026-53449 Medium 6.0 Coturn: Arbitrary File Write via CLI psd Command 0.2%
  • CVE-2026-53448 High 7.2 Coturn: SQL Injection in HTTPS Admin Panel Delete Operations 0.7%
  • CVE-2026-43994 High 8.1 Coturn: Stack buffer overflow in decode_oauth_token_gcm() 0.7%
  • CVE-2026-43915 Medium 5.4 Coturn: Stored Cross-Site Scripting (XSS) in web-admin interface via TURN username 0.2%
  • CVE-2026-40613 High 7.5 Coturn: Misaligned Memory Access in coturn STUN Attribute Parser (Remote DoS on ARM64) 1.1%
  • CVE-2026-27624 High 7.2 Coturn: IPv4-mapped IPv6 (::ffff:0:0/96) bypasses denied-peer-ip ACL 0.3%
  • CVE-2025-69217 High 7.7 Coturn has unsafe nonce and relay port randomization due to weak random number generation. 0.4%
  • CVE-2020-26262 High 7.2 Loopback bypass in Coturn 1.5%
  • CVE-2020-4067 High 7.0 Improper Initialization in coturn 1.9%