{"id":"CVE-2026-62959","title":"Coturn is a free open source implementation of TURN and STUN Server","summary":"Coturn is a free open source implementation of TURN and STUN Server. From 4.5.2 through 4.14.0, when Coturn is started with --acme-redirect <URL> and exposes a plaintext-TCP listener, an unauthenticated remote client can send a single or…","severity":"none","cwe":["CWE-125","CWE-195"],"published":"2026-07-31","updated":"2026-09-09","sourceUpdated":"2026-09-09T20:55:04.493","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-62959","references":[{"url":"https://github.com/coturn/coturn/commit/960835886692fa04cf63ddd970c3f330740c87f4","label":"security-advisories@github.com"},{"url":"https://github.com/coturn/coturn/pull/1965","label":"security-advisories@github.com"},{"url":"https://github.com/coturn/coturn/releases/tag/4.15.0","label":"security-advisories@github.com"},{"url":"https://github.com/coturn/coturn/security/advisories/GHSA-m23x-5qf5-988g","label":"security-advisories@github.com"},{"url":"https://github.com/coturn/coturn/security/advisories/GHSA-m23x-5qf5-988g","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd"],"epss":0.00524,"epssPercentile":0.41923,"ingestedAt":"2026-08-02T00:16:16.387Z","slug":"CVE-2026-62959","body":"## Overview\n\nCoturn is a free open source implementation of TURN and STUN Server. From 4.5.2 through 4.14.0, when Coturn is started with --acme-redirect <URL> and exposes a plaintext-TCP listener, an unauthenticated remote client can send a single ordinary HTTP GET request and receive a 301 response whose Location header contains up to ~870 bytes of adjacent process heap memory. The leaked region is a recycled network receive buffer that is reused without being zeroed, so on a busy server it can contain data from other clients' requests (TURN credentials, OAuth tokens, relayed payloads). Root cause is a signed→unsigned conversion. This issue is fixed in version 4.15.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}