CVE-2026-62959: Coturn: Pre-authentication heap memory disclosure in ACME redirect (`try_acme_redirect`)
Coturn is a free open source implementation of TURN and STUN Server. From 4.5.2 through 4.14.0, when Coturn is started with --acme-redirect <URL> and exposes a plaintext-TCP listener, an unauthenticated remote client can send a single ordinary HTTP GET request and receive a 301 response whose Location header contains up to ~870 bytes of adjacent process heap memory. The leaked region is a recycled network receive buffer that is reused without being zeroed, so on a busy server it can contain data from other clients' requests (TURN credentials, OAuth tokens, relayed payloads). Root cause is a signed→unsigned conversion. This issue is fixed in version 4.15.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
coturnto a version that resolves this vulnerability.Fixed in 4.15.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-62959?
The severity of CVE-2026-62959 is rated at 54.
How do I fix CVE-2026-62959?
To fix CVE-2026-62959, update Coturn to a version later than 4.14.0.
What impact does CVE-2026-62959 have on Coturn servers?
CVE-2026-62959 allows unauthenticated remote clients to disclose heap memory contents via a single HTTP GET request.
Which versions of Coturn are affected by CVE-2026-62959?
Coturn versions from 4.5.2 through 4.14.0 are affected by CVE-2026-62959.
What configuration options exacerbate CVE-2026-62959?
CVE-2026-62959 is exacerbated when Coturn is started with the --acme-redirect option and exposes a plaintext-TCP listener.