# coturn.

Every CVE that names coturn among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Coturn 4.10.0 Uninitialized Stack Memory Disclosure via ERROR-CODE](https://agentprime.io/advisories/CVE-2026-104074.md)
  `CVE-2026-104074` · CVE record: coturn coturn · CVSS 6.9 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Memory corruption
- [coturn: Chained mobility resumes allow authenticated remote memory exhaustion](https://agentprime.io/advisories/CVE-2026-68555.md)
  `CVE-2026-68555` · CVE record: coturn coturn · CVSS 6.5 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Denial of service
- [Coturn: uint16_t truncation overflow in STUN message length causes TCP stream framing bypass](https://agentprime.io/advisories/CVE-2026-68552.md)
  `CVE-2026-68552` · CVE record: coturn coturn · CVSS 5.3 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Memory corruption
- [Coturn: STUN attributes after MESSAGE-INTEGRITY are processed, letting on-path attackers modify authenticated TURN requests](https://agentprime.io/advisories/CVE-2026-68554.md)
  `CVE-2026-68554` · CVE record: coturn coturn · CVSS 2.3 Low · Not analysed yet · Published 19 Aug 2026 · Tags: CWE-345, CWE-924
- [Coturn: Format String Injection via TURN USERNAME/REALM into hiredis Redis Command](https://agentprime.io/advisories/CVE-2026-68553.md)
  `CVE-2026-68553` · CVE record: coturn coturn · CVSS 7.1 High · Not analysed yet · Published 19 Aug 2026 · Tags: Memory corruption
- [coturn: mobility disconnects bypass allocation quotas and exhaust relay capacity](https://agentprime.io/advisories/CVE-2026-73216.md)
  `CVE-2026-73216` · CVE record: coturn coturn · CVSS 6.5 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Denial of service
- [The coturn server can end in a state where it does not accept more requests with "even-port" enabled.](https://agentprime.io/advisories/CVE-2026-73215.md)
  `CVE-2026-73215` · CVE record: coturn coturn · CVSS 7.1 High · Not analysed yet · Published 11 Aug 2026 · Tags: Denial of service
- [coturn allocates a full per-peer SSL/session before verifying the DTLS cookie, enabling source-spoofing/botnet state-exhaustion DoS](https://agentprime.io/advisories/CVE-2026-73214.md)
  `CVE-2026-73214` · CVE record: coturn coturn · CVSS 8.2 High · Not analysed yet · Published 11 Aug 2026 · Tags: Denial of service
- [Coturn: \`addr_less_eq()\` does a component-wise IPv6 comparison instead of a lexicographic one, letting an authenticated TURN client bypass \`denied-peer-ip\`/\`allowed-peer-ip\` IPv6 ranges (TURN-specifi…](https://agentprime.io/advisories/CVE-2026-73213.md)
  `CVE-2026-73213` · CVE record: coturn coturn · CVSS 5.8 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Broken access control
- [coturn peer-IP ACL canonicalization & scope bypass on the RFC 6062 TCP CONNECT relay path → internal-network SSRF and proven internal root RCE](https://agentprime.io/advisories/CVE-2026-73212.md)
  `CVE-2026-73212` · CVE record: coturn coturn · CVSS 5.8 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Broken access control, Server-side request forgery (SSRF)
- [Coturn: MOBILITY-TICKET session-resume authorization bypass allows cross-user TURN allocation takeover](https://agentprime.io/advisories/CVE-2026-65981.md)
  `CVE-2026-65981` · CVE record: coturn coturn · CVSS 7.1 High · Not analysed yet · Published 31 Jul 2026 · Tags: Broken access control
- [Coturn: Pre-authentication heap memory disclosure in ACME redirect (\`try_acme_redirect\`)](https://agentprime.io/advisories/CVE-2026-62959.md)
  `CVE-2026-62959` · CVE record: coturn coturn · CVSS 8.2 High · Not analysed yet · Published 31 Jul 2026 · Tags: Memory corruption, CWE-195
- [Coturn: IPv4-mapped 127.0.0.1 bypasses default loopback peer protection](https://agentprime.io/advisories/CVE-2026-53450.md)
  `CVE-2026-53450` · CVE record: coturn coturn · CVSS 7.4 High · Not analysed yet · Published 10 Jul 2026 · Tags: Server-side request forgery (SSRF)
- [Coturn: Arbitrary File Write via CLI psd Command](https://agentprime.io/advisories/CVE-2026-53449.md)
  `CVE-2026-53449` · CVE record: coturn coturn · CVSS 6.0 Medium · Not analysed yet · Published 10 Jul 2026 · Tags: Path traversal
- [Coturn: SQL Injection in HTTPS Admin Panel Delete Operations](https://agentprime.io/advisories/CVE-2026-53448.md)
  `CVE-2026-53448` · CVE record: coturn coturn · CVSS 7.2 High · Not analysed yet · Published 10 Jul 2026 · Tags: SQL injection
- [Coturn: Stack buffer overflow in decode_oauth_token_gcm()](https://agentprime.io/advisories/CVE-2026-43994.md)
  `CVE-2026-43994` · CVE record: coturn coturn · CVSS 8.1 High · Not analysed yet · Published 18 Jun 2026 · Tags: Memory corruption
- [Coturn: Stored Cross-Site Scripting (XSS) in web-admin interface via TURN username](https://agentprime.io/advisories/CVE-2026-43915.md)
  `CVE-2026-43915` · CVE record: coturn coturn · CVSS 5.4 Medium · Not analysed yet · Published 18 Jun 2026 · Tags: Cross-site scripting (XSS)
- [Coturn: Misaligned Memory Access in coturn STUN Attribute Parser (Remote DoS on ARM64)](https://agentprime.io/advisories/CVE-2026-40613.md)
  `CVE-2026-40613` · CVE record: coturn coturn · CVSS 7.5 High · Not analysed yet · Published 21 Apr 2026 · Tags: CWE-704
- [Coturn: IPv4-mapped IPv6 (::ffff:0:0/96) bypasses denied-peer-ip ACL](https://agentprime.io/advisories/CVE-2026-27624.md)
  `CVE-2026-27624` · CVE record: coturn coturn · CVSS 7.2 High · Not analysed yet · Published 25 Feb 2026 · Tags: Broken access control, CWE-441
- [Coturn has unsafe nonce and relay port randomization due to weak random number generation.](https://agentprime.io/advisories/CVE-2025-69217.md)
  `CVE-2025-69217` · CVE record: coturn coturn · CVSS 7.7 High · Not analysed yet · Published 30 Dec 2025 · Tags: Weak cryptography or TLS
- [Loopback bypass in Coturn](https://agentprime.io/advisories/CVE-2020-26262.md)
  `CVE-2020-26262` · CVE record: coturn coturn · CVSS 7.2 High · Not analysed yet · Published 13 Jan 2021 · Tags: CWE-441, CWE-682
- [Improper Initialization in coturn](https://agentprime.io/advisories/CVE-2020-4067.md)
  `CVE-2020-4067` · CVE record: coturn coturn · CVSS 7.0 High · Not analysed yet · Published 29 Jun 2020 · Tags: CWE-665
- [CoTURN: An exploitable heap out-of-bounds read vulnerability exists in the way CoTURN 4.5.1.1 web…](https://agentprime.io/advisories/CVE-2020-6061.md)
  `CVE-2020-6061` · CVE record: CoTURN · CVSS 7.0 High · Not analysed yet · Published 19 Feb 2020
- [CoTURN: An exploitable denial-of-service vulnerability exists in the way CoTURN 4.5.1.1 web…](https://agentprime.io/advisories/CVE-2020-6062.md)
  `CVE-2020-6062` · CVE record: CoTURN · CVSS 5.9 Medium · Not analysed yet · Published 19 Feb 2020

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=coturn>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/coturn/>. Everything for agents: <https://agentprime.io/llms.txt>.