CVE-2026-68552 Overview
Coturn is a free open source implementation of TURN and STUN servers, widely deployed as a media-relay component for WebRTC and VoIP infrastructure. CVE-2026-68552 is an integer overflow vulnerability [CWE-190] in the stun_get_message_len_str() function in src/client/ns_turn_msg.c. An unauthenticated remote client can send a crafted STUN message over TCP or TLS with a body-length field between 65520 and 65532, causing a uint16_t truncation. The framing layer then desynchronizes and drops the attacking client's connection. The issue is fixed in Coturn 4.15.0.
Critical Impact
Unauthenticated remote attackers can trigger TCP/TLS stream desynchronization on Coturn instances, causing the attacking client's connection to be dropped without impacting the server process or other clients.
Affected Products
- Coturn TURN/STUN Server versions prior to 4.15.0
- Deployments accepting STUN messages over TCP transport
- Deployments accepting STUN messages over TLS transport
Discovery Timeline
- 2026-08-19 - CVE-2026-68552 published to NVD
- 2026-08-19 - Last updated in NVD database
- Coturn 4.15.0 - Fixed release published on GitHub
Technical Details for CVE-2026-68552
Vulnerability Analysis
The vulnerability resides in the STUN message length parser used by Coturn's TCP and TLS framing logic. The parser reads the 16-bit body-length field from an incoming STUN header and adds STUN_HEADER_LENGTH (20 bytes) to compute the total message length. Because the intermediate result is stored in a uint16_t, values between 65520 and 65532 wrap around after the addition, producing a small final length between 4 and 16 bytes.
The truncated length passes the subsequent bounds check against the buffer size. The framing layer then advances the stream cursor by only 4 to 16 bytes and interprets the remainder of the attacker-controlled body as a new STUN message. This desynchronizes the stream parser, and Coturn responds by closing the offending connection. The server process and unrelated clients continue operating normally, which limits the impact to the attacking session.
Root Cause
The defect is a classic integer truncation overflow. The variable uint16_t len cannot represent the sum of the parsed body length and the fixed STUN header size when the body length is close to 0xFFFF. The bounds check on len therefore operates on a truncated value rather than the true message length.
Attack Vector
An unauthenticated remote attacker sends a single crafted STUN packet over TCP or TLS containing a body-length field in the range 65520 through 65532. No authentication, user interaction, or existing session context is required. The impact is limited to the attacker's own connection state.
if (!STUN_VALID_CHANNEL(nswap16(((const uint16_t *)buf)[0]))) {
if ((((uint8_t)buf[0]) & ((uint8_t)(0xC0))) == 0) {
if (nswap32(((const uint32_t *)(buf))[1]) == STUN_MAGIC_COOKIE) {
- uint16_t len = nswap16(((const uint16_t *)(buf))[1]);
- if ((len & 0x0003) == 0) {
+ /* Use uint32_t to avoid uint16_t truncation overflow when the body
+ * length is near 0xFFFF: e.g. 65532 + STUN_HEADER_LENGTH (20) =
+ * 65552, which wraps to 16 in uint16_t and lets the truncated value
+ * pass the bounds check, desynchronizing TCP/TLS framing. Mirrors
+ * the channel-data path below. */
+ uint32_t len = (uint32_t)nswap16(((const uint16_t *)(buf))[1]);
+ if ((len & 0x0003u) == 0) {
len += STUN_HEADER_LENGTH;
- if ((size_t)len <= blen) {
- *app_len = (size_t)len;
+ if (len <= blen) {
+ *app_len = len;
return (int)len;
}
}
Source: GitHub Commit ed32e1f — the fix widens len to uint32_t so the addition of STUN_HEADER_LENGTH cannot truncate.
Detection Methods for CVE-2026-68552
Indicators of Compromise
- Coturn log entries showing abrupt TCP or TLS connection drops immediately after a STUN handshake attempt
- Repeated short-lived TCP or TLS sessions to the Coturn listener from the same source address
- STUN messages on the wire with a body-length header field between 0xFFF0 and 0xFFFC
Detection Strategies
- Inspect network telemetry for STUN packets whose declared length exceeds 65519 bytes on TCP or TLS transports
- Correlate spikes in Coturn connection resets with source IPs that never establish a valid TURN allocation
- Alert on repeated framing errors reported by Coturn against the same remote endpoint within a short window
Monitoring Recommendations
- Forward Coturn stderr and syslog output to a centralized logging platform and retain framing-error entries
- Baseline normal STUN message length distributions per client and flag statistical outliers
- Track connection churn rates on TURN TCP (default 3478) and TURN TLS (default 5349) listeners
How to Mitigate CVE-2026-68552
Immediate Actions Required
- Upgrade all Coturn instances to version 4.15.0 or later
- Restrict exposure of TURN TCP and TLS listeners to trusted networks where feasible
- Enable authenticated TURN usage with long-term credentials to reduce anonymous connection volume
Patch Information
The fix is included in Coturn release 4.15.0 and merged via pull request #1964. Full technical context is available in the GHSA-m562-mf7x-q7rr security advisory. The change widens the length variable to uint32_t, preventing truncation when STUN_HEADER_LENGTH is added to a near-maximum body length.
Workarounds
- Deploy a network-layer filter that drops STUN messages with body-length fields greater than 65519 before they reach Coturn
- Disable TCP and TLS TURN listeners if the deployment only requires UDP transport
- Rate-limit new TCP and TLS connections per source IP at the load balancer or firewall
# Verify the running Coturn version and upgrade if below 4.15.0
turnserver -o --version
# Example: restrict TURN TCP/TLS listeners in turnserver.conf
# listening-port=3478
# tls-listening-port=5349
# no-tcp # disable if TCP listener is not required
# no-tls # disable if TLS listener is not required
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
