CVE-2026-62959: falha de alta gravidade em coturn
Coturn: Pre-authentication heap memory disclosure in ACME redirect (`try_acme_redirect`)
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.2epss 0.5%
Coturn is a free open source implementation of TURN and STUN Server. From 4.5.2 through 4.14.0, when Coturn is started with --acme-redirect <URL> and exposes a plaintext-TCP listener, an unauthenticated remote client can send a single ordinary HTTP GET request and receive a 301 response whose Location header contains up to ~870 bytes of adjacent process heap memory. The leaked region is a recycled network receive buffer that is reused without being zeroed, so on a busy server it can contain data from other clients' requests (TURN credentials, OAuth tokens, relayed payloads). Root cause is a signed→unsigned conversion. This issue is fixed in version 4.15.0.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
coturn · coturnCVEs relacionadas — coturn
No mesmo produto, das mais perigosas para as menos.
CVE-2020-4067HIGHImproper Initialization in coturnEPSS 1.9%CVE-2020-26262HIGHLoopback bypass in CoturnEPSS 1.5%CVE-2026-40613HIGHCoturn: Misaligned Memory Access in coturn STUN Attribute Parser (Remote DoS on ARM64)EPSS 1.1%CVE-2026-53448HIGHCoturn: SQL Injection in HTTPS Admin Panel Delete OperationsEPSS 0.7%CVE-2026-43994HIGHCoturn: Stack buffer overflow in decode_oauth_token_gcm()EPSS 0.7%CVE-2026-73214HIGHcoturn allocates a full per-peer SSL/session before verifying the DTLS cookie, enabling source-spoofing/botnet state-exhaustion DoSEPSS 0.6%