Login Request a demo
CO
Product
coturn
by coturn · last CVE Oct 7, 2026
20
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Vulnerabilities20In the news0Timeline
Severity mix
Critical 1High 9Medium 9Low 1
Severity
All severities20Critical1High9Medium9Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add coturn to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-68555
6.5
1%
Aug 19
coturn: Chained mobility resumes allow authenticated remote memory exhaustion
Affected: >= 4.15.0, < 4.16.0
CVE-2026-73216
6.5
1%
Aug 11
coturn: mobility disconnects bypass allocation quotas and exhaust relay capacity
Affected: < 4.17.0
CVE-2026-27624
6.5
0%
Feb 25
Coturn: IPv4-mapped IPv6 (::ffff:0:0/96) bypasses denied-peer-ip ACL
Affected: < 4.9.0
CVE-2026-53449
6.0
0%
Jul 10
Coturn: Arbitrary File Write via CLI psd Command
Affected: < 4.13.0
CVE-2026-73213
5.8
0%
Aug 11
Coturn: `addr_less_eq()` does a component-wise IPv6 comparison instead of a lexicographic one, letting an authenticated TURN client bypass `denied-peer-ip`/`allowed-peer-ip` IPv6 ranges (TURN-specific SSRF)
Affected: < 4.16.0
CVE-2026-73212
5.8
0%
Aug 11
coturn peer-IP ACL canonicalization & scope bypass on the RFC 6062 TCP CONNECT relay path → internal-network SSRF and proven internal root RCE
Affected: < 4.13.1
CVE-2026-43915
5.4
0%
Jun 18
Coturn: Stored Cross-Site Scripting (XSS) in web-admin interface via TURN username
Affected: < 4.11.0
CVE-2026-104074
5.3
0%
Oct 7
Coturn 4.10.0 Uninitialized Stack Memory Disclosure via ERROR-CODE
Affected: 4.10.0 before 4.11.0
CVE-2026-68552
5.3
1%
Aug 19
Coturn: uint16_t truncation overflow in STUN message length causes TCP stream framing bypass
Affected: < 4.15.0
Showing 9