# CVE-2026-43994: Coturn stack buffer overflow in decode_oauth_token_gcm

Source: https://junglewise.ai/threats/cve-2026-43994-coturn-stack-buffer-overflow-in-decode-oauth-token-gcm  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-18. Updated: 2026-06-21  
License: CC BY 4.0 with a link back

CVE-2026-43994 · Severity: high · CVSS 8.1 · Published 2026-06-18

Coturn is an open-source server used to facilitate WebRTC video and audio communication by helping data bypass firewalls. A security flaw in how the server handles authentication tokens allows an attacker to send a specially crafted message that crashes the service or potentially takes control of the server. While the server must be configured with OAuth enabled to be vulnerable, this is a common setup for professional video conferencing and communication platforms.

Technologies: [Coturn](https://junglewise.ai/threats/technologies/coturn). Vendors: [Coturn](https://junglewise.ai/threats/vendors/coturn).

## Quick answers

**Is CVE-2026-43994 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-43994 being exploited in the wild.

**How severe is CVE-2026-43994?** High severity, with a CVSS score of 8.1, published 18 June 2026.

**Which products and versions are affected?** Coturn < 4.10.0.

**Is there a fix for CVE-2026-43994?** A patch was published on 2026-04-14: Version 4.10.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-43994 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-43994?** Check whether you run Coturn at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack buffer overflow exists in the 'decode_oauth_token_gcm()' function within 'src/client/ns_turn_msg.c'. The vulnerability is caused by a lack of bounds checking on the 'nonce_len' field (a uint16_t) read from an attacker-supplied OAuth access token. This value is passed directly to 'memcpy()', copying up to 65535 bytes into a fixed 256-byte stack buffer ('oauth_encrypted_block.nonce'). Because the overflow occurs before AES-GCM authentication is verified, an attacker does not need a valid OAuth key. Exploitation requires the server to be running in '--oauth' mode. Successful exploitation can lead to corruption of the saved return address, potentially enabling remote code execution (RCE) or causing a process crash (DoS). The issue is fixed in version 4.10.0.

## Affected products

- coturn coturn < 4.10.0

## Timeline

- 2026-04-14: patched: Version 4.10.0 released
- 2026-05-24: advisory: GitHub Security Advisory published
- 2026-06-18: disclosed: CVE published to NVD

## References

- [https://github.com/coturn/coturn/releases/tag/4.10.0](https://github.com/coturn/coturn/releases/tag/4.10.0)
- [https://github.com/coturn/coturn/security/advisories/GHSA-74pg-rfh2-5qw5](https://github.com/coturn/coturn/security/advisories/GHSA-74pg-rfh2-5qw5)

## Related threats

- [Coturn quota bypass in mobility-enabled allocations](https://junglewise.ai/threats/cve-2026-73216-coturn-quota-bypass-in-mobility-enabled-allocations)
- [Coturn EVEN-PORT relay port exhaustion](https://junglewise.ai/threats/cve-2026-73215-coturn-even-port-relay-port-exhaustion)
- [Coturn DTLS memory exhaustion via fragmented ClientHello](https://junglewise.ai/threats/cve-2026-73214-coturn-dtls-memory-exhaustion-via-fragmented-clienthello)
- [Coturn IPv6 range check bypass in TURN relay](https://junglewise.ai/threats/cve-2026-73213-coturn-ipv6-range-check-bypass-in-turn-relay)
- [Coturn TURN/STUN relay ACL bypass via IPv6 address encoding](https://junglewise.ai/threats/cve-2026-73212-coturn-turn-stun-relay-acl-bypass-via-ipv6-address-encoding)