CO
Product
Coturn
14
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 7Medium 3Low 0
Watch
Add Coturn to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-43994 | 9.8 | Jun 18 | Coturn: Stack buffer overflow in decode_oauth_token_gcm() Affected: before 4.10.0 |
| CVE-2020-6061 | 9.8 | Feb 19 | An exploitable heap out-of-bounds read vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests Affected: 4.5.1.1 |
| CVE-2018-4059 | 9.8 | Mar 21 | An exploitable unsafe default configuration vulnerability exists in the TURN server function of coTURN prior to version 4.5.0.9 Affected: before 4.5.0.9 |
| CVE-2018-4056 | 9.8 | Feb 5 | An exploitable SQL injection vulnerability exists in the administrator web portal function of coTURN prior to version 4.5.0.9 Affected: before 4.5.0.9 |
| CVE-2018-4058 | 7.7 | Mar 21 | An exploitable unsafe default configuration vulnerability exists in the TURN server functionality of coTURN prior to 4.5.0.9 Affected: before 4.5.0.9 |
| CVE-2026-40613 | 7.5 | Apr 21 | Coturn: Misaligned Memory Access in coturn STUN Attribute Parser (Remote DoS on ARM64) Affected: before 4.10.0 |
| CVE-2020-4067 | 7.5 | Jun 29 | In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly Affected: before 4.5.1.3 |
| CVE-2020-6062 | 7.5 | Feb 19 | An exploitable denial-of-service vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests Affected: 4.5.1.1 |
| CVE-2026-53450 | 7.4 | Jul 10 | Coturn: IPv4-mapped 127.0.0.1 bypasses default loopback peer protection Affected: before 4.13.0 |
| CVE-2026-53448 | 7.2 | Jul 10 | Coturn: SQL Injection in HTTPS Admin Panel Delete Operations Affected: before 4.12.0 |
| CVE-2020-26262 | 7.2 | Jan 13 | Coturn is free open source implementation of TURN and STUN Server Affected: before 4.5.2 |
| CVE-2026-27624 | 6.5 | Feb 25 | Coturn: IPv4-mapped IPv6 (::ffff:0:0/96) bypasses denied-peer-ip ACL Affected: before 4.9.0 |
| CVE-2026-53449 | 6.0 | Jul 10 | Coturn: Arbitrary File Write via CLI psd Command Affected: before 4.13.0 |
| CVE-2026-43915 | 5.4 | Jun 18 | Coturn: Stored Cross-Site Scripting (XSS) in web-admin interface via TURN username Affected: before 4.11.0 |
Showing 14