CVE-2026-62959 Details
Description
Coturn is a free open source implementation of TURN and STUN Server. From 4.5.2 through 4.14.0, when Coturn is started with --acme-redirect <URL> and exposes a plaintext-TCP listener, an unauthenticated remote client can send a single ordinary HTTP GET request and receive a 301 response whose Location header contains up to ~870 bytes of adjacent process heap memory. The leaked region is a recycled network receive buffer that is reused without being zeroed, so on a busy server it can contain data from other clients' requests (TURN credentials, OAuth tokens, relayed payloads). Root cause is a signed→unsigned conversion. This issue is fixed in version 4.15.0.
A pre-authentication heap memory disclosure vulnerability has been identified in Coturn versions 4.5.2 through 4.14.0. When Coturn is started with the '--acme-redirect <URL>' option and exposes a plaintext-TCP listener, an unauthenticated remote client can send a standard HTTP GET request. This request triggers a 301 response that includes up to approximately 870 bytes of adjacent process heap memory. The leaked memory comes from a recycled network receive buffer that is reused without being cleared, potentially exposing data from other clients' requests, such as TURN credentials, OAuth tokens, and relayed payloads. The vulnerability arises from a signed-to-unsigned conversion error, allowing the improper handling of request paths to bypass validation and leak sensitive memory.
Users can upgrade to Coturn version 4.15.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 31, 2026CISA-ADP
Assessed Jul 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/coturn/coturn/security/advisories/GHSA-m23x-5qf5-988g | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/coturn/coturn/commit/960835886692fa04cf63ddd970c3f330740c87f4 | [email protected] | Source CodeVendor |
| https://github.com/coturn/coturn/pull/1965 | [email protected] | Source CodeVendor |
| https://github.com/coturn/coturn/releases/tag/4.15.0 | [email protected] | Release NotesVendor |
| https://github.com/coturn/coturn/security/advisories/GHSA-m23x-5qf5-988g | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
| CWE-195 | Signed to Unsigned Conversion Error | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Coturn | >= 4.5.2, <= 4.14.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 1, 2026 | CVE Modified | CISA-ADP |
| Jul 31, 2026 | New CVE Received | [email protected] |