SB2026072418 - Multiple vulnerabilities in coTURN

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026072418

SB2026072418 - Multiple vulnerabilities in coTURN

Published: July 24, 2026 Updated: August 3, 2026

Security Bulletin ID SB2026072418
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 75% Low 25%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Out-of-bounds read (CVE-ID: CVE-2026-62959)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in coturn ACME redirect. A remote attacker can trigger an out-of-bounds read error and read contents of memory on the system.


2) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-65981)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to authorization bypass through user-controlled key in the MICE mobility feature. A remote user can gain access to the target application.


3) Improper Enforcement of Message Integrity During Transmission in a Communication Channel (CVE-ID: CVE-2026-68554)

CWE-ID: CWE-924 - Improper Enforcement of Message Integrity During Transmission in a Communication Channel

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to modify authenticated TURN requests.

The vulnerability exists due to improper enforcement of message integrity during transmission in TURN request attribute parsing when processing STUN attributes that appear after MESSAGE-INTEGRITY. A remote attacker can append crafted attributes to an authenticated request and adjust the STUN header length to modify authenticated TURN requests.

Exploitation requires an on-path position and affects plain UDP and TCP listeners; TLS and DTLS deployments are not affected.


4) Integer overflow (CVE-ID: CVE-2026-68552)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer overflow or wraparound in stun_get_message_len_str() when processing crafted STUN messages over TCP/TLS connections. A remote attacker can send a specially crafted STUN message with an oversized body-length field to cause a denial of service.

The issue can be triggered before STUN authentication and affects only the attacking client's own TCP/TLS session by desynchronizing the stream parser and dropping the connection.


Remediation

Install update from vendor's website.

References