CVE-2026-40613 Details
Description
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.10.0, the STUN/TURN attribute parsing functions in coturn perform unsafe pointer casts from uint8_t * to uint16_t * without alignment checks. When processing a crafted STUN message with odd-aligned attribute boundaries, this results in misaligned memory reads at ns_turn_msg.c. On ARM64 architectures (AArch64) with strict alignment enforcement, this causes a SIGBUS signal that immediately kills the turnserver process. An unauthenticated remote attacker can crash any ARM64 coturn deployment by sending a single crafted UDP packet. This vulnerability is fixed in 4.10.0.
A denial-of-service vulnerability has been identified in Coturn versions prior to 4.10.0. The issue arises in the STUN/TURN attribute parsing functions, which perform unsafe pointer casts from uint8_t * to uint16_t * without proper alignment checks. This flaw allows for misaligned memory reads, particularly on ARM64 architectures where strict alignment is enforced. An unauthenticated remote attacker can exploit this vulnerability by sending a single crafted UDP packet, causing the turnserver process to crash. The vulnerability is present in Coturn versions 4.9.0 and earlier.
Users are advised to update Coturn to version 4.10.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/coturn/coturn/security/advisories/GHSA-j662-9wcj-mf36 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/coturn/coturn/security/advisories/GHSA-j662-9wcj-mf36 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-704 | Incorrect Type Conversion or Cast | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| coturn project coturn | < 4.10.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 24, 2026 | Initial Analysis | [email protected] |
| Apr 21, 2026 | CVE Modified | CISA-ADP |
| Apr 21, 2026 | New CVE Received | [email protected] |