Is CVE-2026-43994 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-43994 being exploited in the wild.

How severe is CVE-2026-43994?

High severity, with a CVSS score of 8.1, published 18 June 2026.

Is there a fix for CVE-2026-43994?

A patch was published on 2026-04-14: Version 4.10.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-43994 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-43994?

Check whether you run Coturn at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-43994: Coturn stack buffer overflow in decode_oauth_token_gcm

CVE-2026-43994 · Severity: high · CVSS 8.1 · Published 2026-06-18

Coturn is an open-source server used to facilitate WebRTC video and audio communication by helping data bypass firewalls. A security flaw in how the server handles authentication tokens allows an attacker to send a specially crafted message that crashes the service or potentially takes control of the server. While the server must be configured with OAuth enabled to be vulnerable, this is a common setup for professional video conferencing and communication platforms.

Technologies: Coturn. Vendors: Coturn.

Quick answers

Is CVE-2026-43994 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-43994 being exploited in the wild.
How severe is CVE-2026-43994?: High severity, with a CVSS score of 8.1, published 18 June 2026.
Which products and versions are affected?: Coturn < 4.10.0.
Is there a fix for CVE-2026-43994?: A patch was published on 2026-04-14: Version 4.10.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-43994 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-43994?: Check whether you run Coturn at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stack buffer overflow exists in the 'decode_oauth_token_gcm()' function within 'src/client/ns_turn_msg.c'. The vulnerability is caused by a lack of bounds checking on the 'nonce_len' field (a uint16_t) read from an attacker-supplied OAuth access token. This value is passed directly to 'memcpy()', copying up to 65535 bytes into a fixed 256-byte stack buffer ('oauth_encrypted_block.nonce'). Because the overflow occurs before AES-GCM authentication is verified, an attacker does not need a valid OAuth key. Exploitation requires the server to be running in '--oauth' mode. Successful exploitation can lead to corruption of the saved return address, potentially enabling remote code execution (RCE) or causing a process crash (DoS). The issue is fixed in version 4.10.0.

Affected products

coturn coturn < 4.10.0

Timeline

2026-04-14: patched: Version 4.10.0 released
2026-05-24: advisory: GitHub Security Advisory published
2026-06-18: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.