coturn

Records27All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical4CVSS 9.0–10.0

CVSS high14CVSS 7.0–8.9

Exploited now

coturn records in CISA KEV

No coturn vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Coturn 14 records HIGH

Records

27 records

TI-2026-32037 CVE-2026-43994

Coturn: Stack buffer overflow in decode_oauth_token_gcm()

HIGH 76

Coturn is a free open source implementation of TURN and STUN Server.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00675 Published 2026-06-18 Fixed in 4.10.0 CWE-120

TI-2026-44985 CVE-2026-62959

Coturn: Pre-authentication heap memory disclosure in ACME redirect (`try_acme_redirect`)

HIGH 75

Coturn is a free open source implementation of TURN and STUN Server.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00524 Published 2026-07-31 Fixed in 4.15.0 CWE-125

TI-2026-29348 CVE-2026-40613

Coturn: Misaligned Memory Access in coturn STUN Attribute Parser (Remote DoS on ARM64)

HIGH 72

Coturn is a free open source implementation of TURN and STUN Server.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01123 Published 2026-04-21 Fixed in 4.10.0 CWE-704

TI-2026-22006 CVE-2026-27624

Coturn: IPv4-mapped IPv6 (::ffff:0:0/96) bypasses denied-peer-ip ACL

HIGH 71

Coturn is a free open source implementation of TURN and STUN Server.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00345 Published 2026-02-25 Fixed in 4.9.0 CWE-284

TI-2026-38529 CVE-2026-53448

Coturn: SQL Injection in HTTPS Admin Panel Delete Operations

HIGH 67

Coturn is a free open source implementation of TURN and STUN Server.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00704 Published 2026-07-10 Fixed in 4.12.0 CWE-89

TI-2026-46994 CVE-2026-65981

Coturn: MOBILITY-TICKET session-resume authorization bypass allows cross-user TURN allocation takeover

HIGH 66

Coturn is a free open source implementation of TURN and STUN Server.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00389 Published 2026-07-31 Fixed in 4.15.0 CWE-639

TI-2026-38531 CVE-2026-53450

Coturn: IPv4-mapped 127.0.0.1 bypasses default loopback peer protection

HIGH 66

Coturn is a free open source implementation of TURN and STUN Server.

CVSS 3.1HIGH 7.4 Network Low privileges No interaction EPSS 0.0029 Published 2026-07-10 Fixed in 4.13.0 CWE-918

TI-2026-48302 CVE-2026-68553

Coturn: Format String Injection via TURN USERNAME/REALM into hiredis Redis Command

MEDIUM 64

Coturn is a free open source implementation of TURN and STUN Server.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.0048 Published 2026-08-19 Fixed in 4.13.0 CWE-134

TI-2026-51353 CVE-2026-73216

coturn: mobility disconnects bypass allocation quotas and exhaust relay capacity

MEDIUM 62

Coturn is a free open source implementation of TURN and STUN Server.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0057 Published 2026-08-11 Fixed in 4.17.0 CWE-400

TI-2026-48304 CVE-2026-68555

coturn: Chained mobility resumes allow authenticated remote memory exhaustion

MEDIUM 62

Coturn is a free open source implementation of TURN and STUN Server.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0053 Published 2026-08-19 Fixed in 4.16.0 CWE-400

TI-2026-38530 CVE-2026-53449

Coturn: Arbitrary File Write via CLI psd Command

MEDIUM 60

Coturn is a free open source implementation of TURN and STUN Server.

CVSS 3.1MEDIUM 6.0 Local High privileges No interaction EPSS 0.00207 Published 2026-07-10 Fixed in 4.13.0 CWE-73

TI-2026-51350 CVE-2026-73213

Incorrect authorization in coturn

MEDIUM 59

Coturn is a free open source implementation of TURN and STUN Server.

CVSS 4.0MEDIUM 5.8 Network Low privileges No interaction EPSS 0.00414 Published 2026-08-11 Fixed in 4.16.0 CWE-863

TI-2020-04928 CVE-2020-6061 · GHSA-9vj8-fr5m-q39w

Out-of-bounds read in CoTURN

MEDIUM 50

An exploitable heap out-of-bounds read vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.05116 Published 2020-02-19 No fix listed CWE-125

TI-2018-03024 CVE-2018-4056 · GHSA-c3pf-948r-8592

SQL injection in Talos coTURN

MEDIUM 47

An exploitable SQL injection vulnerability exists in the administrator web portal function of coTURN prior to version 4.5.0.9.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02955 Published 2019-02-05 No fix listed CWE-89

TI-2018-03026 CVE-2018-4059 · GHSA-7q4q-c7wp-55p8

Missing authorization in Talos coTURN

MEDIUM 46

An exploitable unsafe default configuration vulnerability exists in the TURN server function of coTURN prior to version 4.5.0.9.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01897 Published 2019-03-21 No fix listed CWE-862

TI-2026-48303 CVE-2026-68554

Insufficient verification of data authenticity in coturn

MEDIUM 45

Coturn is a free open source implementation of TURN and STUN Server.

CVSS 4.0LOW 2.3 Adjacent network No auth No interaction EPSS 0.00188 Published 2026-08-19 Fixed in 4.15.0 CWE-345

TI-2020-04929 CVE-2020-6062 · GHSA-8m27-48h2-7f6h

NULL pointer dereference in CoTURN

MEDIUM 42

An exploitable denial-of-service vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.06102 Published 2020-02-19 No fix listed CWE-476

TI-2020-03549 CVE-2020-4067

Improper Initialization in coturn

LOW 37

In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01898 Published 2020-06-29 Fixed in 6.0.0 CWE-665

TI-2026-69155 CVE-2026-104074 · GHSA-6h6j-pfrh-66v3

Uninitialized stack memory leak in Coturn via ERROR-CODE replies

LOW 36

Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote unauthenticated attackers to leak stack memory contents by sending a TURN Allocate request without credentials.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00311 Published 2026-10-07 Fixed in 4.11.0 CWE-908

TI-2026-51351 CVE-2026-73214

Uncontrolled resource consumption in coturn

LOW 36

Coturn is a free open source implementation of TURN and STUN Server.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00577 Published 2026-08-11 Fixed in 4.16.0 CWE-400

TI-2020-16083 CVE-2020-26262

Loopback bypass in Coturn

LOW 35

Coturn is free open source implementation of TURN and STUN Server.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.01547 Published 2021-01-13 Fixed in 4.5.2 CWE-441

TI-2018-03025 CVE-2018-4058 · GHSA-j75v-963h-65p5

An exploitable unsafe default configuration vulnerability exists in the TURN server…

LOW 35

An exploitable unsafe default configuration vulnerability exists in the TURN server functionality of coTURN prior to 4.5.0.9.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00918 Published 2019-03-21 No fix listed

TI-2025-42671 CVE-2025-69217

Coturn has unsafe nonce and relay port randomization due to weak random number generation.

LOW 34

coturn is a free open source implementation of TURN and STUN Server.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00412 Published 2025-12-30 No fix listed CWE-338

TI-2026-51352 CVE-2026-73215

The coturn server can end in a state where it does not accept more requests with "even-port" enabled.

LOW 32

Coturn is a free open source implementation of TURN and STUN Server.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00451 Published 2026-08-11 Fixed in 4.17.0 CWE-400

TI-2026-48301 CVE-2026-68552

Coturn: uint16_t truncation overflow in STUN message length causes TCP stream framing bypass

LOW 31

Coturn is a free open source implementation of TURN and STUN Server.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00524 Published 2026-08-19 Fixed in 4.15.0 CWE-190

Open these records in search →