CVE-2026-68553: Coturn TURN/STUN Server DoS Vulnerability

CVE-2026-68553 Overview

Coturn is a widely deployed open-source implementation of the Traversal Using Relays around NAT (TURN) and Session Traversal Utilities for NAT (STUN) protocols. CVE-2026-68553 is a format string vulnerability [CWE-134] affecting Coturn versions prior to 4.13.0. An authenticated TURN user can inject printf-style format specifiers into the STUN USERNAME or REALM attribute. These attacker-controlled values reach redisAsyncCommand() as the format string, triggering out-of-bounds reads from the va_list. The issue is fixed in version 4.13.0.

Critical Impact
Successful exploitation crashes the Coturn process, terminating active TURN sessions, and may disclose stack memory contents into the Redis backend.

Affected Products

Coturn TURN/STUN Server versions prior to 4.13.0
Deployments using the Redis backend for user or session state
Any service relying on Coturn for WebRTC or VoIP media relay

Discovery Timeline

2026-08-19 - CVE-2026-68553 published to the National Vulnerability Database (NVD)
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-68553

Vulnerability Analysis

The flaw stems from unsafe handling of authenticated STUN attributes. An attacker with valid TURN credentials submits a USERNAME or REALM value containing format specifiers such as %s, %x, or %n. The is_secure_string() validation routine treats these bytes as printable and allows them through.

The attribute is then embedded into a Redis key at nine call sites within src/apps/relay/ns_ioalib_engine_impl.c. When send_message_to_redis() in src/apps/relay/hiredis_libevent2.c executes, it forwards the attacker-controlled key directly as the format argument to redisAsyncCommand().

Because only one variadic value is supplied, hiredisredisvFormatCommand() reads past the end of the va_list. The result is either a process crash from dereferencing an invalid pointer or leakage of adjacent stack memory into the Redis store.

Root Cause

The root cause is classified under [CWE-134] Use of Externally-Controlled Format String. User-supplied STUN attributes flow into a format string parameter without sanitization or use of a fixed format literal.

Attack Vector

Exploitation requires network access and valid TURN credentials. The attacker sends a crafted STUN message where the USERNAME or REALM attribute contains format specifiers. Coturn processes the authenticated request and constructs a Redis key that reaches redisAsyncCommand() as its format string.

// Patch excerpt from src/apps/relay/hiredis_libevent2.c
 ///////////// Messages ////////////////////////////
 
 struct redis_message {
-  char format[513];
   char arg[513];
 };

Source: GitHub Commit 8fa3803

The patch removes the caller-supplied format buffer from the Redis message structure, forcing the code path to use a static format string rather than concatenating attacker input.

Detection Methods for CVE-2026-68553

Indicators of Compromise

STUN USERNAME or REALM attributes containing % characters followed by format specifiers such as %s, %x, %p, or %n
Unexpected Coturn process crashes or restarts correlated with authenticated TURN traffic
Redis keys containing unprintable bytes, hexadecimal fragments, or pointer-like values that resemble leaked stack memory

Detection Strategies

Inspect Coturn access logs and Redis key namespaces for entries containing % format tokens in user or realm fields
Correlate Coturn crash events and core dumps with recent authentication requests from the same source address
Deploy application-layer inspection at the TURN listener to reject STUN attributes containing format specifier patterns

Monitoring Recommendations

Alert on abnormal termination of the turnserver process and on repeated session drops for active TURN allocations
Monitor Redis for keys containing non-ASCII bytes or unusually long values written by the Coturn service account
Track authentication events from clients that submit malformed or oversized USERNAME and REALM attributes

How to Mitigate CVE-2026-68553

Immediate Actions Required

Upgrade Coturn to version 4.13.0 or later on all TURN/STUN nodes
Rotate long-term TURN credentials if authenticated abuse is suspected
Review Redis contents for keys containing format specifiers and purge suspicious entries

Patch Information

The fix is available in Coturn 4.13.0. See the GitHub Release 4.13.0 and the GitHub Security Advisory GHSA-4g7c-p5wg-j4hp for full details. The upstream patch is documented in GitHub Commit 8fa3803.

Workarounds

Restrict TURN authentication to trusted users only and disable open or shared-secret provisioning until patched
Deploy an upstream filter or reverse proxy that rejects STUN messages whose USERNAME or REALM attributes contain % characters
Isolate the Redis backend on a dedicated network segment to limit the blast radius of any memory disclosure

bash

# Verify installed Coturn version and upgrade
turnserver -h | head -n 1
# Expected output for the fixed release:
#   Version Coturn-4.13.0

# Example package upgrade (Debian/Ubuntu)
sudo apt-get update && sudo apt-get install --only-upgrade coturn
sudo systemctl restart coturn