What’s Vulnerable › Products

coturn vulnerabilities

27 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 20 published in the last 12 months.

Check whether your coturn version is affected

Latest coturn vulnerabilities

• CVE-2026-104074 — Coturn 4.10.0 Uninitialized Stack Memory Disclosure via ERROR-CODE (CVSS 5.3)
• CVE-2026-68555 — coturn: Chained mobility resumes allow authenticated remote memory exhaustion (CVSS 6.5)
• CVE-2026-68554 — Coturn: STUN attributes after MESSAGE-INTEGRITY are processed, letting on-path attackers modify authenticated TURN requests (CVSS 2.3)
• CVE-2026-68553 — Coturn: Format String Injection via TURN USERNAME/REALM into hiredis Redis Command (CVSS 7.1)
• CVE-2026-68552 — Coturn: uint16_t truncation overflow in STUN message length causes TCP stream framing bypass (CVSS 5.3)
• CVE-2026-73216 — coturn: mobility disconnects bypass allocation quotas and exhaust relay capacity (CVSS 6.5)
• CVE-2026-73215 — The coturn server can end in a state where it does not accept more requests with "even-port" enabled. (CVSS 7.1)
• CVE-2026-73214 — coturn allocates a full per-peer SSL/session before verifying the DTLS cookie, enabling source-spoofing/botnet state-exhaustion DoS (CVSS 8.2)
• CVE-2026-73213 — Coturn: `addr_less_eq()` does a component-wise IPv6 comparison instead of a lexicographic one, letting an authenticated TURN client bypass `denied-peer-ip`/`allowed-peer-ip` IPv6 ranges (TURN-specific SSRF) (CVSS 5.8)
• CVE-2026-73212 — coturn peer-IP ACL canonicalization & scope bypass on the RFC 6062 TCP CONNECT relay path → internal-network SSRF and proven internal root RCE (CVSS 5.8)
• CVE-2026-65981 — Coturn: MOBILITY-TICKET session-resume authorization bypass allows cross-user TURN allocation takeover (CVSS 7.1)
• CVE-2026-62959 — Coturn: Pre-authentication heap memory disclosure in ACME redirect (`try_acme_redirect`) (CVSS 8.2)
• CVE-2026-53450 — Coturn: IPv4-mapped 127.0.0.1 bypasses default loopback peer protection (CVSS 7.4)
• CVE-2026-53449 — Coturn: Arbitrary File Write via CLI psd Command (CVSS 6.0)
• CVE-2026-53448 — Coturn: SQL Injection in HTTPS Admin Panel Delete Operations (CVSS 7.2)
• CVE-2026-43994 — Coturn: Stack buffer overflow in decode_oauth_token_gcm() (CVSS 9.8)
• CVE-2026-43915 — Coturn: Stored Cross-Site Scripting (XSS) in web-admin interface via TURN username (CVSS 5.4)
• CVE-2026-40613 — Coturn: Misaligned Memory Access in coturn STUN Attribute Parser (Remote DoS on ARM64) (CVSS 7.5)
• CVE-2026-27624 — Coturn: IPv4-mapped IPv6 (::ffff:0:0/96) bypasses denied-peer-ip ACL (CVSS 6.5)
• CVE-2025-69217 — Coturn has unsafe nonce and relay port randomization due to weak random number generation. (CVSS 7.7)
• CVE-2020-26262 — Loopback bypass in Coturn (CVSS 7.2)
• CVE-2020-4067 — Improper Initialization in coturn (CVSS 7.5)
• CVE-2020-6062 — (CVSS 7.5)
• CVE-2020-6061 — (CVSS 9.8)
• CVE-2018-4059 — (CVSS 9.8)