---
id: CVE-2026-62959
title: Coturn is a free open source implementation of TURN and STUN Server
summary: >-
  Coturn is a free open source implementation of TURN and STUN Server. From
  4.5.2 through 4.14.0, when Coturn is started with --acme-redirect <URL> and
  exposes a plaintext-TCP listener, an unauthenticated remote client can send a
  single or…
severity: none
cwe:
  - CWE-125
  - CWE-195
published: '2026-07-31'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T20:55:04.493'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-62959'
references:
  - url: >-
      https://github.com/coturn/coturn/commit/960835886692fa04cf63ddd970c3f330740c87f4
    label: security-advisories@github.com
  - url: 'https://github.com/coturn/coturn/pull/1965'
    label: security-advisories@github.com
  - url: 'https://github.com/coturn/coturn/releases/tag/4.15.0'
    label: security-advisories@github.com
  - url: 'https://github.com/coturn/coturn/security/advisories/GHSA-m23x-5qf5-988g'
    label: security-advisories@github.com
  - url: 'https://github.com/coturn/coturn/security/advisories/GHSA-m23x-5qf5-988g'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00524
epssPercentile: 0.42099
ingestedAt: '2026-08-02T00:16:16.387Z'
---

## Overview

Coturn is a free open source implementation of TURN and STUN Server. From 4.5.2 through 4.14.0, when Coturn is started with --acme-redirect <URL> and exposes a plaintext-TCP listener, an unauthenticated remote client can send a single ordinary HTTP GET request and receive a 301 response whose Location header contains up to ~870 bytes of adjacent process heap memory. The leaked region is a recycled network receive buffer that is reused without being zeroed, so on a busy server it can contain data from other clients' requests (TURN credentials, OAuth tokens, relayed payloads). Root cause is a signed→unsigned conversion. This issue is fixed in version 4.15.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.