CVE-2026-68553: Coturn: Format String Injection via TURN USERNAME/REALM into hiredis Redis Command
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, an authenticated TURN user can place printf-style format specifiers in the STUN USERNAME or REALM attribute, which passes issecurestring() validation and is embedded into Redis keys at nine call sites in src/apps/relay/nsioalibengineimpl.c. sendmessagetoredis() in src/apps/relay/hiredislibevent2.c then passes the attacker-controlled key as the format argument to redisAsyncCommand() while supplying only one variadic value, causing hiredis redisvFormatCommand() to read past the valist. Exploitation can crash the coturn process and terminate active TURN sessions or disclose stack memory into Redis. This issue is fixed in version 4.13.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
coturnto a version that resolves this vulnerability.Fixed in 4.13.0 - Compensating control
If upgrading to coturn 4.13.0 is not immediately possible, mitigate impact by preventing access to the coturn TURN service from untrusted networks/clients (e.g., restrict TURN ports/management access via firewall/ACL) to reduce exposure to authenticated attackers able to inject malicious STUN USERNAME/REALM values.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated TURN user can exploit it by placing printf-style format specifiers in STUN USERNAME or REALM attributes. The attack is network-reachable and does not require user interaction.
What impact should operators expect from successful exploitation?
Exploitation can crash the Coturn process, terminating active TURN sessions. It may also disclose stack memory into Redis.
Are deployments using Redis affected?
The vulnerable path embeds attacker-controlled USERNAME or REALM values into Redis keys and sends them through hiredis. Deployments using the affected Coturn versions prior to 4.13.0 should update to 4.13.0.