CVE-2026-68552: Coturn: uint16_t truncation overflow in STUN message length causes TCP stream framing bypass
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an unauthenticated remote client can send a STUN message over TCP or TLS with a body-length field from 65520 through 65532, causing the uint16t len variable in stungetmessagelenstr() in src/client/nsturnmsg.c to wrap when STUNHEADERLENGTH is added. The framing layer then consumes only 4 through 16 bytes, treats the remaining bytes as another message, desynchronizes the stream parser, and drops the attacking client's connection. Other clients and the server process are not affected. This issue is fixed in version 4.15.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
coturnto a version that resolves this vulnerability.Fixed in 4.15.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Coturn versions before 4.15.0 are affected when they accept STUN messages over TCP or TLS. UDP traffic is not identified as affected.
What does an attacker need to exploit it?
An unauthenticated remote client only needs network access to send a crafted STUN message over TCP or TLS. No privileges or user interaction are required.
What is the practical impact on a Coturn service?
The crafted message desynchronizes the TCP stream parser and causes the attacking client's connection to be dropped. The issue does not affect other clients or the Coturn server process.
What should be done if the service cannot be upgraded immediately?
The provided data identifies upgrading to Coturn 4.15.0 as the fix. It does not provide a workaround or mitigation for affected TCP or TLS listeners.