What’s Vulnerable › Vulnerabilities

CVE-2020-6061

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 5.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-02-19 · updated 2026-06-17
• Weakness: CWE-125

Description

An exploitable heap out-of-bounds read vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. A specially crafted HTTP POST request can lead to information leaks and other misbehavior. An attacker needs to send an HTTPS request to trigger this vulnerability.

Affected products

• Canonical Ubuntu Linux: 16.04, 18.04, 19.10, 20.04
• coturn: 4.5.1.1
• Debian Linux: 9.0, 10.0
• Fedoraproject Fedora: 30, 31, 32

References

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQZZPI34LAS3SFNW6Z2ZJ46RKVGEODNA/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OUVZRXW5ZIGWVKOLF3NPXRPP74YX7BUY/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XN2NK6FT7AMW5UIZNXDNHKEAYWAUMGSF/
• https://talosintelligence.com/vulnerability_reports/TALOS-2020-0984
• https://usn.ubuntu.com/4415-1/
• https://www.debian.org/security/2020/dsa-4711
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQZZPI34LAS3SFNW6Z2ZJ46RKVGEODNA/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OUVZRXW5ZIGWVKOLF3NPXRPP74YX7BUY/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XN2NK6FT7AMW5UIZNXDNHKEAYWAUMGSF/
• https://talosintelligence.com/vulnerability_reports/TALOS-2020-0984
• https://usn.ubuntu.com/4415-1/
• https://www.debian.org/security/2020/dsa-4711

Get alerted when CVE-2020-6061 or the next vulnerability affects your stack