coturn vulnerabilities

CVEs per yearBy the year they were published

1. 20201
2. 20211
3. 20251
4. 202619

Newest CVEs

• CVE-2026-104074

  Coturn 4.10.0 Uninitialized Stack Memory Disclosure via ERROR-CODE

  coturn · coturn

  Medium6.9
• CVE-2026-68555

  coturn: Chained mobility resumes allow authenticated remote memory exhaustion

  coturn · coturn

  Medium6.5
• CVE-2026-68552

  Coturn: uint16_t truncation overflow in STUN message length causes TCP stream framing bypass

  coturn · coturn

  Medium5.3
• CVE-2026-68554

  Coturn: STUN attributes after MESSAGE-INTEGRITY are processed, letting on-path attackers modify authenticated TURN requests

  coturn · coturn

  Low2.3
• CVE-2026-68553

  Coturn: Format String Injection via TURN USERNAME/REALM into hiredis Redis Command

  coturn · coturn

  High7.1
• CVE-2026-73216

  coturn: mobility disconnects bypass allocation quotas and exhaust relay capacity

  coturn · coturn

  Medium6.5
• CVE-2026-73215

  The coturn server can end in a state where it does not accept more requests with "even-port" enabled.

  coturn · coturn

  High7.1
• CVE-2026-73214

  coturn allocates a full per-peer SSL/session before verifying the DTLS cookie, enabling source-spoofing/botnet state-exhaustion DoS

  coturn · coturn

  High8.2
• CVE-2026-73213

  Coturn: `addr_less_eq()` does a component-wise IPv6 comparison instead of a lexicographic one, letting an authenticated TURN client bypass `denied-peer-ip`/`allowed-peer-ip` IPv6 ranges (TURN-specific SSRF)

  coturn · coturn

  Medium5.8
• CVE-2026-73212

  coturn peer-IP ACL canonicalization & scope bypass on the RFC 6062 TCP CONNECT relay path → internal-network SSRF and proven internal root RCE

  coturn · coturn

  Medium5.8