Remote Client Exploit in Coturn TURN and STUN Server by Errored Frame Length

CVE-2026-68552

What is CVE-2026-68552?

In Coturn, an open-source implementation of TURN and STUN servers, a vulnerability exists that allows unauthenticated remote clients to exploit a STUN message overflow. When clients send a malformed message with a body-length field from 65520 to 65532, it causes the length variable in the message handler to wrap, leading to incorrect processing of the incoming data. This mismanagement creates a scenario where the parser desynchronizes, dropping connections from attacking clients while leaving other clients and the server operational. This flaw has been resolved in version 4.15.0, underscoring the importance of keeping server software updated.

References