Coturn up to 4.14.x STUN Message Parser src/client/ns_turn_msg.c stun_get_message_len_str improper synchronization

Summaryinfo

A vulnerability marked as problematic has been reported in Coturn up to 4.14.x. Affected is the function stun_get_message_len_str of the file src/client/ns_turn_msg.c of the component STUN Message Parser. The manipulation leads to improper synchronization. This vulnerability is referenced as CVE-2026-68552. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability was found in Coturn up to 4.14.x. It has been rated as problematic. This issue affects the function stun_get_message_len_str of the file src/client/ns_turn_msg.c of the component STUN Message Parser. The manipulation with an unknown input leads to a improper synchronization vulnerability. Using CWE to declare the problem leads to CWE-662. The product utilizes multiple threads or processes to allow temporary access to a shared resource that can only be exclusive to one process at a time, but it does not properly synchronize these actions, which might cause simultaneous accesses of this resource by multiple threads or processes. Impacted is availability. The summary by CVE is:

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an unauthenticated remote client can send a STUN message over TCP or TLS with a body-length field from 65520 through 65532, causing the uint16_t len variable in stun_get_message_len_str() in src/client/ns_turn_msg.c to wrap when STUN_HEADER_LENGTH is added. The framing layer then consumes only 4 through 16 bytes, treats the remaining bytes as another message, desynchronizes the stream parser, and drops the attacking client's connection. Other clients and the server process are not affected. This issue is fixed in version 4.15.0.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-68552 since 07/30/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available.

Upgrading to version 4.15.0 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• Coturn

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5
• 4.6
• 4.7
• 4.8
• 4.9
• 4.10
• 4.11
• 4.12
• 4.13
• 4.14

Website

• Product: https://github.com/coturn/coturn/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion