Medium severity · published Aug 19, 2026
CVE-2026-68552
Coturn: uint16_t truncation overflow in STUN message length causes TCP stream framing bypass
5.3
CVSS
0.5%
EPSS
No
On KEV
Description
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an unauthenticated remote client can send a STUN message over TCP or TLS with a body-length field from 65520 through 65532, causing the uint16_t len variable in stun_get_message_len_str() in src/client/ns_turn_msg.c to wrap when STUN_HEADER_LENGTH is added. The framing layer then consumes only 4 through 16 bytes, treats the remaining bytes as another message, desynchronizes the stream parser, and drops the attacking client's connection. Other clients and the server process are not affected. This issue is fixed in version 4.15.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
coturn · coturn
< 4.15.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-68552
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-68552
github.com
https://github.com/coturn/coturn/commit/ed32e1fb6c843f9cf9a28d91c541dfbf40874f25
github.com
https://github.com/coturn/coturn/pull/1964
github.com
https://github.com/coturn/coturn/releases/tag/4.15.0
github.com
https://github.com/coturn/coturn/security/advisories/GHSA-m562-mf7x-q7rr
More from coturn
9.8
CVE-2026-43994
Coturn: Stack buffer overflow in decode_oauth_token_gcm()
8.2
CVE-2026-73214
coturn allocates a full per-peer SSL/session before verifying the DTLS cookie, enabling source-spoofing/botnet state-exhaustion DoS
8.2
CVE-2026-62959
Coturn: Pre-authentication heap memory disclosure in ACME redirect (`try_acme_redirect`)
7.7
CVE-2025-69217
Coturn has unsafe nonce and relay port randomization due to weak random number generation.
7.5
CVE-2026-40613
Coturn: Misaligned Memory Access in coturn STUN Attribute Parser (Remote DoS on ARM64)