Read the docs
TI-2026-69155 Aliases CVE-2026-104074GHSA-6h6j-pfrh-66v3

Uninitialized stack memory leak in Coturn via ERROR-CODE replies

Priority LOW 36CWE-908Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-908 and the CVSS impact.

Summary

Coturn from 4.10.0 before 4.11.0 contains an uninitialized memory disclosure flaw (CWE-908). The stun_init_error_response_common_str() function does not zero-initialize a buffer, so leftover stack bytes are copied into the ERROR-CODE reason phrase. An unauthenticated remote attacker can read these stack contents, exposing pointer fragments that weaken ASLR and allow precise version fingerprinting.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote unauthenticated attackers to leak stack memory contents by sending a TURN Allocate request without credentials. Attackers can exploit the stun_init_error_response_common_str() function in src/client/ns_turn_msg.c, which fails to zero-initialize the avalue buffer before computing its length with strlen() and copying leaked stack bytes into the ERROR-CODE reason phrase, exposing pointer fragments that weaken ASLR and enable precise version fingerprinting.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00311 24th percentileScored 2026-11-07
Fix Fixed coturn (coturn): 4.11.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
coturncoturn4.10.0 to before 4.11.04.11.0Patch availableCNA
  • coturn Vendorcoturn Affected 4.10.0 to before 4.11.0 Fixed in 4.11.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:coturn_project:coturn:*:*:*:*:*:*:*:*——coturn
  • cpe:2.3:a:coturn_project:coturn:*:*:*:*:*:*:*:* Versions — — ·coturn

Remediation

Upgrade coturn to version 4.11.0, which fixes this flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA coturn (coturn) Fixed in 4.11.0

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-07 Threatist record created from CVE-2026-104074
  2. 2026-10-07 Alias added: GHSA-6h6j-pfrh-66v3
  3. 2026-10-07 CISA SSVC decision points changed
  4. 2026-10-07 Priority changed: MEDIUM → LOW
  5. 2026-10-08 Affected versions changed · Red Hat
  6. 2026-10-08 CVSS score added · Red Hat

References

Patch 1

Other 2

  • TI-2026-32037 Coturn: Stack buffer overflow in decode_oauth_token_gcm() CVSS 3.1CRITICAL 9.8
  • TI-2026-44985 Coturn: Pre-authentication heap memory disclosure in ACME redirect (`try_acme_redirect`) CVSS 4.0HIGH 8.2
  • TI-2026-29348 Coturn: Misaligned Memory Access in coturn STUN Attribute Parser (Remote DoS on ARM64) CVSS 3.1HIGH 7.5
  • TI-2026-22006 Coturn: IPv4-mapped IPv6 (::ffff:0:0/96) bypasses denied-peer-ip ACL CVSS 3.1HIGH 7.2
  • TI-2026-38529 Coturn: SQL Injection in HTTPS Admin Panel Delete Operations CVSS 3.1HIGH 7.2
  • TI-2026-46994 Coturn: MOBILITY-TICKET session-resume authorization bypass allows cross-user TURN allocation takeover CVSS 3.1HIGH 7.1
See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences