CVE-2026-62959: Coturn Information Disclosure Vulnerability

CVE-2026-62959 Overview

Coturn is a free open source implementation of TURN (Traversal Using Relays around NAT) and STUN (Session Traversal Utilities for NAT) servers. Versions 4.5.2 through 4.14.0 contain an out-of-bounds read vulnerability [CWE-125] in the ACME redirect handler. When Coturn runs with --acme-redirect <URL> and exposes a plaintext-TCP listener, an unauthenticated remote attacker can send a single HTTP GET request. The server returns a 301 response whose Location header contains up to approximately 870 bytes of adjacent process heap memory. The leaked region is a recycled network receive buffer, so it can contain data from concurrent client sessions.

Critical Impact
Unauthenticated attackers can extract TURN credentials, OAuth tokens, and relayed payloads from other clients by issuing a single crafted HTTP GET to the plaintext-TCP listener.

Affected Products

Coturn versions 4.5.2 through 4.14.0 (inclusive)
Deployments started with the --acme-redirect <URL> option
Instances exposing a plaintext-TCP listener alongside ACME redirect

Discovery Timeline

2026-07-31 - CVE-2026-62959 published to NVD
2026-08-01 - Last updated in NVD database
Fixed in - Coturn version 4.15.0

Technical Details for CVE-2026-62959

Vulnerability Analysis

The flaw resides in src/apps/relay/acme.c within the ACME request handler. The function is_acme_req() returns a negative int on every rejection path to indicate failure. The vulnerable code assigned this return value directly to a size_t variable named plen. Signed-to-unsigned conversion wraps the negative value to a very large unsigned integer. This wrapped value slips past the intended lower-bound length check.

With plen now enormous, the subsequent statement req[plen] = '\0' cannot terminate the request buffer at the intended offset. The following snprintf() call formats the path with %s, over-reading adjacent heap memory until an unrelated NUL byte is encountered. The over-read data is embedded into the Location header of the 301 response. Since the receive buffer is reused across connections without zeroing, leaked bytes may include TURN long-term credentials, OAuth tokens, and relayed media payloads from other clients.

Root Cause

The root cause is an unchecked signed-to-unsigned integer conversion combined with in-place mutation of a shared receive buffer. Negative sentinel values from is_acme_req() were coerced into size_t before validation, defeating the length guard.

Attack Vector

Exploitation requires network reachability to the plaintext-TCP listener and a Coturn instance launched with --acme-redirect. The attacker sends one ordinary HTTP GET request crafted to trigger the rejection path in is_acme_req(). No authentication, credentials, or user interaction are required.

// Security patch in src/apps/relay/acme.c
// Source: https://github.com/coturn/coturn/commit/960835886692fa04cf63ddd970c3f330740c87f4

   if (url == NULL || url[0] == '\0' || req == NULL || s == 0) {
     return 1;
   }
-  size_t plen;
+  // is_acme_req() returns a negative int on every rejection path. Capture it in
+  // a signed int and reject negatives *before* any unsigned use: assigning the
+  // negative value into a size_t would wrap it to a huge number that slips past
+  // the lower-bound guard, leaving the path un-terminated and causing the %s
+  // below to over-read adjacent heap into the response (CVE: heap disclosure).
+  int prc;
   if (len < (GET_ACME_PREFIX_LEN + 32) || len > (512 - GET_ACME_PREFIX_LEN) ||
-      (plen = is_acme_req(req, len)) < (GET_ACME_PREFIX_LEN + 1)) {
+      (prc = is_acme_req(req, len)) < (int)(GET_ACME_PREFIX_LEN + 1)) {
     return 2;
   }
+  size_t plen = (size_t)prc;

-  req[plen] = '\0';
+  // Copy the path out and NUL-terminate it locally rather than mutating the
+  // shared receive buffer in place (req[plen] = '\0' / ' ').
+  size_t path_len = plen - GET_ACME_PREFIX_LEN;
+  char path[131 + 1] = {0};
+  if (path_len >= sizeof(path)) {
+    return 2;
+  }
+  memcpy(path, req + GET_ACME_PREFIX_LEN, path_len);
+  path[path_len] = '\0';

   snprintf(http_response, sizeof(http_response) - 1,
            "HTTP/1.1 301 Moved Permanently\r\n"

The patch captures the return value in a signed int, validates it before conversion, and copies the path into a local bounded buffer instead of mutating the shared receive buffer.

Detection Methods for CVE-2026-62959

Indicators of Compromise

HTTP GET requests sent to Coturn plaintext-TCP listener ports that fall below the GET_ACME_PREFIX_LEN + 32 length threshold or exceed 512 - GET_ACME_PREFIX_LEN bytes.
Outbound 301 responses from Coturn whose Location header exceeds expected URL length or contains non-ASCII, binary, or credential-shaped substrings.
Repeated short GET probes from the same source targeting /.well-known/acme-challenge` prefixes.

Detection Strategies

Inspect Coturn access logs for HTTP GET requests reaching the TURN/STUN listener rather than a dedicated HTTP service.
Deploy network signatures that flag 301 responses from Coturn with Location headers longer than a legitimate ACME redirect URL.
Correlate exposure of --acme-redirect configuration with the presence of any plaintext-TCP listener in host inventory data.

Monitoring Recommendations

Monitor Coturn process command-line arguments across the fleet to enumerate hosts running with --acme-redirect.
Alert on any inbound TCP connections to Coturn ports whose payload starts with GET rather than a STUN/TURN binding header.
Track version strings from deployed Coturn binaries and flag any release earlier than 4.15.0.

How to Mitigate CVE-2026-62959

Immediate Actions Required

Upgrade Coturn to version 4.15.0 or later on all affected hosts.
If patching is not immediately possible, remove the --acme-redirect flag from the Coturn startup configuration.
Rotate any TURN long-term credentials and OAuth tokens that may have transited affected servers.

Patch Information

The fix is available in Coturn 4.15.0. The corrective commit is 960835886692fa04cf63ddd970c3f330740c87f4. Additional context is available in the GitHub Security Advisory GHSA-m23x-5qf5-988g and the upstream pull request.

Workarounds

Disable ACME redirect by removing --acme-redirect from service arguments and restart the daemon.
Terminate TLS in front of Coturn and block plaintext-TCP listener exposure at the network edge.
Restrict inbound access to the Coturn TCP listener with firewall rules that only permit trusted client ranges.

bash

# Configuration example: remove ACME redirect and restart Coturn
# /etc/turnserver.conf — ensure no acme-redirect directive is present
sudo sed -i '/^acme-redirect/d' /etc/turnserver.conf
sudo systemctl restart coturn

# Verify the running process no longer includes --acme-redirect
ps -ef | grep turnserver | grep -v grep

# Confirm the installed version is 4.15.0 or newer
turnserver -h | head -1