Skip to content
Coturn vulnerabilities
Newest
-
coturn
Coturn 4.10.0 Uninitialized Stack Memory Disclosure via ERROR-CODE
CVE-2026-104074
Fix available
6.9 Medium
-
coturn
coturn: Chained mobility resumes allow authenticated remote memory exhaustion
CVE-2026-68555
Fix available
6.5 Medium
-
coturn
Coturn: uint16_t truncation overflow in STUN message length causes TCP stream framing bypass
CVE-2026-68552
Fix available
5.3 Medium
-
coturn
Coturn: STUN attributes after MESSAGE-INTEGRITY are processed, letting on-path attackers modify authenticated TURN requests
CVE-2026-68554
Fix available
2.3 Low
-
coturn
Coturn: Format String Injection via TURN USERNAME/REALM into hiredis Redis Command
CVE-2026-68553
Fix available
7.1 High
-
coturn
coturn: mobility disconnects bypass allocation quotas and exhaust relay capacity
CVE-2026-73216
Fix available
6.5 Medium
-
coturn
The coturn server can end in a state where it does not accept more requests with "even-port" enabled.
CVE-2026-73215
Fix available
7.1 High
-
coturn
coturn allocates a full per-peer SSL/session before verifying the DTLS cookie, enabling source-spoofing/botnet state-exhaustion DoS
CVE-2026-73214
Fix available
8.2 High
-
coturn
Coturn: `addr_less_eq()` does a component-wise IPv6 comparison instead of a lexicographic one, letting an authenticated TURN client bypass `denied-peer-ip`/`allowed-peer-ip` IPv6 ranges (TURN-specific…
CVE-2026-73213
Fix available
5.8 Medium
-
coturn
coturn peer-IP ACL canonicalization & scope bypass on the RFC 6062 TCP CONNECT relay path → internal-network SSRF and proven internal root RCE
CVE-2026-73212
Fix available
5.8 Medium
-
coturn
Coturn: MOBILITY-TICKET session-resume authorization bypass allows cross-user TURN allocation takeover
CVE-2026-65981
Fix available
7.1 High
-
coturn
Coturn: Pre-authentication heap memory disclosure in ACME redirect (`try_acme_redirect`)
CVE-2026-62959
Fix available
8.2 High
-
coturn
Coturn: IPv4-mapped 127.0.0.1 bypasses default loopback peer protection
CVE-2026-53450
Fix available
7.4 High
-
coturn
Coturn: Arbitrary File Write via CLI psd Command
CVE-2026-53449
Fix available
6.0 Medium
-
coturn
Coturn: SQL Injection in HTTPS Admin Panel Delete Operations
CVE-2026-53448
Fix available
7.2 High
-
coturn
Coturn: Stack buffer overflow in decode_oauth_token_gcm()
CVE-2026-43994
Fix available
8.1 High
-
coturn
Coturn: Stored Cross-Site Scripting (XSS) in web-admin interface via TURN username
CVE-2026-43915
Fix available
5.4 Medium
-
coturn
Coturn: Misaligned Memory Access in coturn STUN Attribute Parser (Remote DoS on ARM64)
CVE-2026-40613
Fix available
7.5 High
-
coturn
Coturn: IPv4-mapped IPv6 (::ffff:0:0/96) bypasses denied-peer-ip ACL
CVE-2026-27624
Fix available
7.2 High
-
coturn
Coturn has unsafe nonce and relay port randomization due to weak random number generation.
CVE-2025-69217
Fix available
7.7 High
-
coturn, fedoraproject fedora +1 more
Loopback bypass in Coturn
CVE-2020-26262
Fix available
7.2 High
-
coturn, canonical ubuntu linux, debian linux +2 more +4 more
Improper Initialization in coturn
CVE-2020-4067
Fix available
7.0 High
-
coturn, canonical ubuntu linux, debian linux +1 more +3 more
An exploitable heap overflow vulnerability exists in the way CoTURN 4.5.1.1 web server parses...
CVE-2020-6061
Fix available
7.0 High
-
coturn, canonical ubuntu linux, debian linux +1 more +3 more
An exploitable denial-of-service vulnerability exists in the way CoTURN 4.5.1.1 web server parses...
CVE-2020-6062
Fix available
5.9 Medium
-
coturn
An exploitable unsafe default configuration vulnerability exists in the TURN server function of...
CVE-2018-4059
Fix available
6.5 Medium
-
coturn
An exploitable unsafe default configuration vulnerability exists in the TURN server functionality...
CVE-2018-4058
Fix available
7.7 High
-
coturn, debian linux +1 more
An exploitable SQL injection vulnerability exists in the administrator web portal function of...
CVE-2018-4056
Fix available
9.1 Critical