Executive brief
Coturn, an open-source server used for relaying web communication (STUN/TURN), contains a flaw that can leak sensitive information from its memory. When a specific redirect feature is enabled, an unauthenticated attacker can send a simple web request to the server and receive back snippets of internal memory. This leaked data may include other users' login credentials, security tokens, or private communication data, potentially leading to account takeovers or broader data breaches.
Technical details
An out-of-bounds read vulnerability exists in the try_acme_redirect() function of Coturn. The root cause is a signed-to-unsigned conversion error where the integer return value of is_acme_req() (which returns negative values on failure) is stored in a size_t variable. This causes negative values to wrap to large unsigned integers, bypassing length checks and resulting in an un-terminated path string. When this path is later used in a 301 Location header via a %s format specifier, the server reads adjacent heap memory until it encounters a null byte. This can leak recycled network buffers containing sensitive data from other sessions. The issue is fixed in version 4.15.0.
Affected products
- coturn coturn >= 4.5.2, < 4.15.0
Timeline
- 2026-06-27: patched: Fix committed to master branch
- 2026-07-22: advisory: Release 4.15.0 published
- 2026-07-31: disclosed: CVE published to NVD