{"id":"CVE-2020-26262","aliases":["ALPINE-CVE-2020-26262","DEBIAN-CVE-2020-26262","DLA-2522-1","DSA-4829-1","EUVD-2020-18850","GHSA-6g6j-r9rf-cm7p","MGASA-2021-0087","UBUNTU-CVE-2020-26262","USN-4690-1","openSUSE-SU-2024:10696-1"],"status":"published","title":"Loopback bypass in Coturn","description":"Coturn is free open source implementation of TURN and STUN Server. Coturn before version 4.5.2 by default does not allow peers to connect and relay packets to loopback addresses in the range of `127.x.x.x`. However, it was observed that when sending a `CONNECT` request with the `XOR-PEER-ADDRESS` value of `0.0.0.0`, a successful response was received and subsequently, `CONNECTIONBIND` also received a successful response. Coturn then is able to relay packets to the loopback interface. Additionally, when coturn is listening on IPv6, which is default, the loopback interface can also be reached by making use of either `[::1]` or `[::]` as the peer address. By using the address `0.0.0.0` as the peer address, a malicious user will be able to relay packets to the loopback interface, unless `--denied-peer-ip=0.0.0.0` (or similar) has been specified. Since the default configuration implies that loopback peers are not allowed, coturn administrators may choose to not set the `denied-peer-ip` setting. The issue patched in version 4.5.2. As a workaround the addresses in the address block `0.0.0.0/8`, `[::1]` and `[::]` should be denied by default unless `--allow-loopback-peers` has been specified.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01547,"percentile":0.75201,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-441","CWE-682"],"published":"2021-01-11T00:00:00Z","modified":"2026-11-03T06:32:24Z","fixes":[{"ecosystem":"Alpine:v3.13","package":"coturn","fixed_in":["4.5.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"coturn","fixed_in":["4.5.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"coturn","fixed_in":["4.5.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"coturn","fixed_in":["4.5.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"coturn","fixed_in":["4.5.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"coturn","fixed_in":["4.5.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"coturn","fixed_in":["4.5.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"coturn","fixed_in":["4.5.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"coturn","fixed_in":["4.5.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"coturn","fixed_in":["4.5.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"coturn","fixed_in":["4.5.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"coturn","fixed_in":["4.5.2-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"coturn","fixed_in":["4.5.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"coturn","fixed_in":["4.5.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"coturn","fixed_in":["4.5.2-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"coturn","fixed_in":["4.5.0.5-1+deb9u3"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"coturn","fixed_in":["4.5.1.1-1.1+deb10u2"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"coturn","fixed_in":["4.5.2-1.4.mga7"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"coturn","fixed_in":["4.5.0.3-1ubuntu0.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"coturn","fixed_in":["4.5.0.7-1ubuntu2.18.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"coturn","fixed_in":["4.5.1.1-1.1ubuntu0.20.04.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.13","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.0.5-1+deb9u3"}]}],"versions":["4.5.0.5-1","4.5.0.5-1+deb9u1","4.5.0.5-1+deb9u2"]},{"source":"osv","ecosystem":"Debian:10","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1.1-1.1+deb10u2"}]}],"versions":["4.5.1.1-1.1","4.5.1.1-1.1+deb10u1"]},{"source":"osv","ecosystem":"Mageia:7","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2-1.4.mga7"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.0.3-1ubuntu0.4"}]}],"versions":["4.4.5.4-2","4.5.0.2-3","4.5.0.3-1","4.5.0.3-1build1","4.5.0.3-1ubuntu0.2","4.5.0.3-1ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.0.7-1ubuntu2.18.04.3"}]}],"versions":["4.5.0.6-1ubuntu2","4.5.0.7-1ubuntu1","4.5.0.7-1ubuntu2","4.5.0.7-1ubuntu2.18.04.1","4.5.0.7-1ubuntu2.18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1.1-1.1ubuntu0.20.04.2"}]}],"versions":["4.5.1.1-1.1build1","4.5.1.1-1.1build2","4.5.1.1-1.1ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.0.3-1ubuntu0.4"}]}],"versions":["4.4.5.4-2","4.5.0.2-3","4.5.0.3-1","4.5.0.3-1build1","4.5.0.3-1ubuntu0.2","4.5.0.3-1ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.0.7-1ubuntu2.18.04.3"}]}],"versions":["4.5.0.6-1ubuntu2","4.5.0.7-1ubuntu1","4.5.0.7-1ubuntu2","4.5.0.7-1ubuntu2.18.04.1","4.5.0.7-1ubuntu2.18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1.1-1.1ubuntu0.20.04.2"}]}],"versions":["4.5.1.1-1.1build1","4.5.1.1-1.1build2","4.5.1.1-1.1ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2-2.2"}]}],"bundled":3}],"products":[{"vendor":"coturn","product":"coturn"},{"vendor":"coturn_project","product":"coturn"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"https://github.com/coturn/coturn/security/advisories/GHSA-6g6j-r9rf-cm7p","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Third Party Advisory","evidence","advisory","report"]},{"url":"https://github.com/coturn/coturn/commit/abfe1fd08d78baa0947d17dac0f7411c3d948e4d","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/coturn/coturn/blob/57180ab60afcaeb13537e69ae8cb8aefd8f3f546/ChangeLog#L48","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G54UIUFTEC6RLPOISMB6FUW7456SBZC4/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M4CJOPAQT43MYAFU3UROGLEXN3Z6RS4H/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-26262","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-26262","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0087.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28068","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-26262","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4690-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-26262","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-4067","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6061","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-26262","title":"Loopback bypass in Coturn","description":"Coturn is free open source implementation of TURN and STUN Server. Coturn before version 4.5.2 by default does not allow peers to connect and relay packets to loopback addresses in the range of `127.x.x.x`. However, it was observed that when sending a `CONNECT` request with the `XOR-PEER-ADDRESS` value of `0.0.0.0`, a successful response was received and subsequently, `CONNECTIONBIND` also received a successful response. Coturn then is able to relay packets to the loopback interface. Additionally, when coturn is listening on IPv6, which is default, the loopback interface can also be reached by making use of either `[::1]` or `[::]` as the peer address. By using the address `0.0.0.0` as the peer address, a malicious user will be able to relay packets to the loopback interface, unless `--denied-peer-ip=0.0.0.0` (or similar) has been specified. Since the default configuration implies that loopback peers are not allowed, coturn administrators may choose to not set the `denied-peer-ip` setting. The issue patched in version 4.5.2. As a workaround the addresses in the address block `0.0.0.0/8`, `[::1]` and `[::]` should be denied by default unless `--allow-loopback-peers` has been specified.","status":"published","published":"2021-01-13T18:15:17Z","modified":"2024-08-04T15:56:03.733Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-441","CWE-682"],"updated_at":"2026-11-02T14:35:45.763329Z"}],"euvd":[{"id":"EUVD-2020-18850","description":"Coturn is free open source implementation of TURN and STUN Server. Coturn before version 4.5.2 by default does not allow peers to connect and relay packets to loopback addresses in the range of `127.x.x.x`. However, it was observed that when sending a `CONNECT` request with the `XOR-PEER-ADDRESS` value of `0.0.0.0`, a successful response was received and subsequently, `CONNECTIONBIND` also received a successful response. Coturn then is able to relay packets to the loopback interface. Additionally, when coturn is listening on IPv6, which is default, the loopback interface can also be reached by making use of either `[::1]` or `[::]` as the peer address. By using the address `0.0.0.0` as the peer address, a malicious user will be able to relay packets to the loopback interface, unless `--denied-peer-ip=0.0.0.0` (or similar) has been specified. Since the default configuration implies that loopback peers are not allowed, coturn administrators may choose to not set the `denied-peer-ip` setting. The issue patched in version 4.5.2. As a workaround the addresses in the address block `0.0.0.0/8`, `[::1]` and `[::]` should be denied by default unless `--allow-loopback-peers` has been specified.","status":"published","published":"2021-01-13T18:15:17Z","modified":"2024-08-04T15:56:03Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"updated_at":"2026-11-03T03:07:15.778249Z"}],"nvd":[{"id":"CVE-2020-26262","description":"Coturn is free open source implementation of TURN and STUN Server. Coturn before version 4.5.2 by default does not allow peers to connect and relay packets to loopback addresses in the range of `127.x.x.x`. However, it was observed that when sending a `CONNECT` request with the `XOR-PEER-ADDRESS` value of `0.0.0.0`, a successful response was received and subsequently, `CONNECTIONBIND` also received a successful response. Coturn then is able to relay packets to the loopback interface. Additionally, when coturn is listening on IPv6, which is default, the loopback interface can also be reached by making use of either `[::1]` or `[::]` as the peer address. By using the address `0.0.0.0` as the peer address, a malicious user will be able to relay packets to the loopback interface, unless `--denied-peer-ip=0.0.0.0` (or similar) has been specified. Since the default configuration implies that loopback peers are not allowed, coturn administrators may choose to not set the `denied-peer-ip` setting. The issue patched in version 4.5.2. As a workaround the addresses in the address block `0.0.0.0/8`, `[::1]` and `[::]` should be denied by default unless `--allow-loopback-peers` has been specified.","status":"published","published":"2021-01-13T19:15:16.027Z","modified":"2026-06-17T03:07:56.967Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-441","CWE-682"],"updated_at":"2026-11-02T14:06:28.892872Z"}],"osv":[{"id":"ALPINE-CVE-2020-26262","description":"Coturn is free open source implementation of TURN and STUN Server. Coturn before version 4.5.2 by default does not allow peers to connect and relay packets to loopback addresses in the range of `127.x.x.x`. However, it was observed that when sending a `CONNECT` request with the `XOR-PEER-ADDRESS` value of `0.0.0.0`, a successful response was received and subsequently, `CONNECTIONBIND` also received a successful response. Coturn then is able to relay packets to the loopback interface. Additionally, when coturn is listening on IPv6, which is default, the loopback interface can also be reached by making use of either `[::1]` or `[::]` as the peer address. By using the address `0.0.0.0` as the peer address, a malicious user will be able to relay packets to the loopback interface, unless `--denied-peer-ip=0.0.0.0` (or similar) has been specified. Since the default configuration implies that loopback peers are not allowed, coturn administrators may choose to not set the `denied-peer-ip` setting. The issue patched in version 4.5.2. As a workaround the addresses in the address block `0.0.0.0/8`, `[::1]` and `[::]` should be denied by default unless `--allow-loopback-peers` has been specified.","status":"published","published":"2021-01-13T19:15:16.027Z","modified":"2026-11-03T06:32:24.930047576Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"updated_at":"2026-11-03T07:17:57.723967Z"},{"id":"CVE-2020-26262","description":"Coturn is free open source implementation of TURN and STUN Server. Coturn before version 4.5.2 by default does not allow peers to connect and relay packets to loopback addresses in the range of `127.x.x.x`. However, it was observed that when sending a `CONNECT` request with the `XOR-PEER-ADDRESS` value of `0.0.0.0`, a successful response was received and subsequently, `CONNECTIONBIND` also received a successful response. Coturn then is able to relay packets to the loopback interface. Additionally, when coturn is listening on IPv6, which is default, the loopback interface can also be reached by making use of either `[::1]` or `[::]` as the peer address. By using the address `0.0.0.0` as the peer address, a malicious user will be able to relay packets to the loopback interface, unless `--denied-peer-ip=0.0.0.0` (or similar) has been specified. Since the default configuration implies that loopback peers are not allowed, coturn administrators may choose to not set the `denied-peer-ip` setting. The issue patched in version 4.5.2. As a workaround the addresses in the address block `0.0.0.0/8`, `[::1]` and `[::]` should be denied by default unless `--allow-loopback-peers` has been specified.","status":"published","published":"2021-01-13T19:15:16.027Z","modified":"2026-10-20T10:52:57.107299764Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:16.248747Z"},{"id":"DEBIAN-CVE-2020-26262","description":"Coturn is free open source implementation of TURN and STUN Server. Coturn before version 4.5.2 by default does not allow peers to connect and relay packets to loopback addresses in the range of `127.x.x.x`. However, it was observed that when sending a `CONNECT` request with the `XOR-PEER-ADDRESS` value of `0.0.0.0`, a successful response was received and subsequently, `CONNECTIONBIND` also received a successful response. Coturn then is able to relay packets to the loopback interface. Additionally, when coturn is listening on IPv6, which is default, the loopback interface can also be reached by making use of either `[::1]` or `[::]` as the peer address. By using the address `0.0.0.0` as the peer address, a malicious user will be able to relay packets to the loopback interface, unless `--denied-peer-ip=0.0.0.0` (or similar) has been specified. Since the default configuration implies that loopback peers are not allowed, coturn administrators may choose to not set the `denied-peer-ip` setting. The issue patched in version 4.5.2. As a workaround the addresses in the address block `0.0.0.0/8`, `[::1]` and `[::]` should be denied by default unless `--allow-loopback-peers` has been specified.","status":"published","published":"2021-01-13T19:15:16.027Z","modified":"2026-10-26T12:01:07.020483885Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:33.729655Z"},{"id":"UBUNTU-CVE-2020-26262","description":"Coturn is free open source implementation of TURN and STUN Server. Coturn before version 4.5.2 by default does not allow peers to connect and relay packets to loopback addresses in the range of `127.x.x.x`. However, it was observed that when sending a `CONNECT` request with the `XOR-PEER-ADDRESS` value of `0.0.0.0`, a successful response was received and subsequently, `CONNECTIONBIND` also received a successful response. Coturn then is able to relay packets to the loopback interface. Additionally, when coturn is listening on IPv6, which is default, the loopback interface can also be reached by making use of either `[::1]` or `[::]` as the peer address. By using the address `0.0.0.0` as the peer address, a malicious user will be able to relay packets to the loopback interface, unless `--denied-peer-ip=0.0.0.0` (or similar) has been specified. Since the default configuration implies that loopback peers are not allowed, coturn administrators may choose to not set the `denied-peer-ip` setting. The issue patched in version 4.5.2. As a workaround the addresses in the address block `0.0.0.0/8`, `[::1]` and `[::]` should be denied by default unless `--allow-loopback-peers` has been specified.","status":"published","published":"2021-01-11T00:00:00Z","modified":"2026-02-04T03:39:55.115408Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"},{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:23.905183Z"},{"id":"DLA-2522-1","title":"coturn - security update","status":"published","published":"2021-01-12T00:00:00Z","modified":"2026-03-09T01:21:56.480099Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DSA-4829-1","title":"coturn - security update","status":"published","published":"2021-01-11T00:00:00Z","modified":"2026-03-09T02:11:28.021031Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2021-0087","title":"Updated coturn package fixes a security vulnerability","description":"When sending a CONNECT request with the XOR-PEER-ADDRESS value of 0.0.0.0, a\nmalicious user would be able to relay packets to the loopback interface.\nAdditionally, when coturn is listening on IPv6, which is default, the loopback\ninterface can also be reached by making use of either [::1] or [::] as the peer\naddress (CVE-2020-26262).\n\nIf updating is not possible, the setting --denied-peer-ip=0.0.0.0 can mitigate\nthis issue.\n\nThe coturn package has been patched to fix this issue.\n","status":"published","published":"2021-02-19T10:27:54Z","modified":"2026-04-16T04:44:19.027969426Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2024:10696-1","title":"coturn-4.5.2-2.2 on GA media","description":"These are all security issues fixed in the coturn-4.5.2-2.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:57:21.994588Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"USN-4690-1","title":"coturn vulnerability","description":"It was discovered that coTURN allowed peers to connect and relay packets to\nloopback addresses in the range of 127.x.x.x. A malicious user could use this\nvulnerability to insert packages into the loopback interface.\n","status":"published","published":"2021-01-11T21:19:33Z","modified":"2026-02-10T04:42:02Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}