CVE-2026-68553
Description
A flaw was found in Coturn. An authenticated TURN user can exploit a format string vulnerability by injecting printf-style format specifiers into the STUN USERNAME or REALM attribute. This can lead to a crash of the coturn process, resulting in a Denial of Service (DoS) and termination of active TURN sessions. Additionally, this vulnerability may disclose sensitive stack memory into Redis.
Statement
Coturn is not shipped in any Red Hat product. The Fedora and EPEL community builds ship coturn version 4.17.2, which already includes the fix for this issue (fixed in 4.13.0) and are therefore not affected.
Mitigation
Upgrade to coturn version 4.13.0 or later.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Memory
Format string problems allow for information disclosure which can severely simplify exploitation of the program.
Integrity,Confidentiality,Availability
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Format string problems can result in the execution of arbitrary code, buffer overflows, denial of service, or incorrect data representation.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
