CVE-2026-62959 in Coturn
Summary
by MITRE • 07/31/2026
Coturn is a free open source implementation of TURN and STUN Server. From 4.5.2 through 4.14.0, when Coturn is started with --acme-redirect <URL> and exposes a plaintext-TCP listener, an unauthenticated remote client can send a single ordinary HTTP GET request and receive a 301 response whose Location header contains up to ~870 bytes of adjacent process heap memory. The leaked region is a recycled network receive buffer that is reused without being zeroed, so on a busy server it can contain data from other clients' requests (TURN credentials, OAuth tokens, relayed payloads). Root cause is a signed→unsigned conversion. This issue is fixed in version 4.15.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/31/2026
The vulnerability in Coturn versions 4.5.2 through 4.14.0 represents a critical information disclosure flaw that arises from improper memory handling within the server's HTTP response generation mechanism. This vulnerability specifically manifests when the server operates with the --acme-redirect flag while exposing plaintext-TCP listeners, creating an attack surface where unauthenticated remote clients can exploit a fundamental design flaw in how HTTP redirect responses are constructed and transmitted.
The technical root cause of this vulnerability stems from a signed to unsigned integer conversion error that occurs during the processing of HTTP redirect requests. When an unauthenticated client sends a single HTTP GET request to a Coturn server configured with --acme-redirect, the server responds with a 301 redirect status code containing a Location header that inadvertently leaks approximately 870 bytes of adjacent heap memory. This memory leakage occurs because the network receive buffer, which is allocated from a pool of recycled buffers, is reused without proper sanitization or zeroing before being populated with data for the HTTP response.
The operational impact of this vulnerability extends beyond simple information disclosure, as the leaked memory can contain sensitive data from other concurrent connections including TURN server credentials, OAuth authentication tokens, and potentially relayed network payloads that were processed by the same server instance. On busy servers where multiple clients maintain active connections, the likelihood of memory contamination increases significantly since recycled buffers may still contain remnants of previous client communications. This makes the vulnerability particularly dangerous in production environments where Coturn serves multiple users or applications with varying levels of security sensitivity.
This vulnerability aligns with CWE-200 (Information Exposure) and represents a classic example of how improper memory management can lead to data leakage in network services. The issue also maps to ATT&CK technique T1005 (Data from Local System) where attackers can extract sensitive information through memory corruption or improper handling of buffer contents. The flaw demonstrates poor secure coding practices related to buffer reuse and memory sanitization, particularly in server applications that handle multiple concurrent connections and process sensitive authentication data.
The fix implemented in version 4.15.0 addresses the core issue by ensuring proper zeroing of network receive buffers before reuse or by preventing the inclusion of potentially contaminated memory in HTTP response headers. This mitigation approach aligns with industry best practices for preventing information disclosure vulnerabilities, specifically addressing the root cause of the signed to unsigned conversion that allowed memory contents to be inadvertently exposed through HTTP responses. Organizations running affected versions should prioritize immediate upgrade to version 4.15.0 or later to prevent potential exploitation and protect sensitive data flowing through their Coturn implementations.
The vulnerability highlights the importance of proper memory management in server applications handling authentication tokens and sensitive network data, particularly when implementing features like automatic certificate management through ACME protocols. The issue demonstrates how seemingly innocuous HTTP redirect functionality can become a vector for significant information disclosure when combined with improper buffer handling practices in high-concurrency server environments where multiple clients share the same memory pool resources.