What’s Vulnerable › Vulnerabilities

CVE-2026-104074: Coturn 4.10.0 Uninitialized Stack Memory Disclosure via ERROR-CODE

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-07 · updated 2026-10-27
• Weakness: CWE-908

Description

Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote unauthenticated attackers to leak stack memory contents by sending a TURN Allocate request without credentials. Attackers can exploit the stun_init_error_response_common_str() function in src/client/ns_turn_msg.c, which fails to zero-initialize the avalue buffer before computing its length with strlen() and copying leaked stack bytes into the ERROR-CODE reason phrase, exposing pointer fragments that weaken ASLR and enable precise version fingerprinting.

Affected products

• coturn: from 4.10.0 before 4.11.0 — fixed in 4.11.0

How to fix

Upgrade to a fixed version: coturn 4.11.0. Check the vendor advisory for mitigations.

References

• https://github.com/coturn/coturn/commit/741b2983cc52f967dd08c438fd72a5f08f13ca27
• https://github.com/coturn/coturn/pull/1878
• https://github.com/coturn/coturn/releases/tag/4.11.0

Get alerted when CVE-2026-104074 or the next vulnerability affects your stack