CVE-2026-122126

reSIProcate reTurn client through 1.14.0 Heap Buffer Overflow via TurnTcpSocket

8.2 High

reSIProcate reTurn client through 1.14.0 contains a heap buffer overflow in TurnTcpSocket::handleReadHeader(), which TurnTlsSocket inherits, that allows malicious TURN servers or on-path attackers to overwrite memory via oversized frame lengths. Attackers can send STUN or ChannelData frames declaring up to 65535 bytes, writing roughly 57 KB past the fixed 8192-byte mReadBuffer and crashing the client. Only the synchronous TCP and TLS client is affected; the asynchronous client (TurnAsyncSocket) and the reTurn server are not.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.37%Unchanged since Nov 5, 2026

What each source reports

CVE List Score used 8.2

reSIProcate reTurn client through 1.14.0 Heap Buffer Overflow via TurnTcpSocket

Record: CVE-2026-122126
CVSS 4.0: 8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-122
Updated: 2026-11-05

EUVDEUVD-2026-117081 8.2

Record: EUVD-2026-117081
CVSS 4.0: 8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-05

GitHub AdvisoriesGHSA-32v3-8rp4-cq83 8.2

reSIProcate reTurn client through 1.14.0 contains a heap buffer overflow in TurnTcpSocket:...

reSIProcate reTurn client through 1.14.0 contains a heap buffer overflow in TurnTcpSocket::handleReadHeader() that allows malicious TURN servers to overwrite memory via oversized frame lengths. Attackers can send STUN or ChannelData frames declaring up to 65535 bytes, writing roughly 57 KB past the fixed 8192-byte mReadBuffer and crashing the client.

Record: GHSA-32v3-8rp4-cq83
CVSS 4.0: 8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-122
Updated: 2026-11-04

NVD 8.2

Record: CVE-2026-122126
CVSS 4.0: 8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-122
Updated: 2026-11-05

OSV 8.2

reSIProcate reTurn client through 1.14.0 Heap Buffer Overflow via TurnTcpSocket

Record: CVE-2026-122126
CVSS 4.0: 8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness: CWE-122
Updated: 2026-11-07

OSVUBUNTU-CVE-2026-122126 8.2

Record: UBUNTU-CVE-2026-122126
CVSS 4.0: 8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-06

Affected products

resiprocate

Affected packages

Affected packages
Package	Affected	Fixed
`resiprocate` Ubuntu:Pro:14.04:LTS	All versions, plus listed versions 1.8.14-11.9.0~beta6-11.9.0~beta6-21.9.0~beta7-11.9.2-2 Show 6 moreShow less 1.9.4-11.9.5-11.9.5-21.9.6-11:1.9.7-4~ubuntu14.04.11:1.9.7-4~ubuntu14.04.1+esm1	None known
`resiprocate` Ubuntu:16.04:LTS	All versions, plus listed versions 1:1.10.0-11:1.10.1-11:1.10.1-21:1.10.1-2ubuntu1	None known
`resiprocate` Ubuntu:18.04:LTS	All versions, plus listed versions 1:1.11.0~beta5-1	None known

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, aliases, references	CVE List, EUVD, NVD, OSV
Nov 5, 2026	description	CVE List, EUVD
Nov 5, 2026	references	OSV
Nov 5, 2026	published	EUVD
Nov 4, 2026	published	EUVD, NVD
Nov 4, 2026	aliases, published	EUVD
Nov 4, 2026	first indexed	CVE List, GitHub Advisories

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-122126 is a high vulnerability (CVSS 8.2) in Resiprocate, published November 4, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 30th percentile. No source names a fixed version.

References

Show 4 moreShow less