CVE-2026-68553

NameCVE-2026-68553
DescriptionCoturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, an authenticated TURN user can place printf-style format specifiers in the STUN USERNAME or REALM attribute, which passes is_secure_string() validation and is embedded into Redis keys at nine call sites in src/apps/relay/ns_ioalib_engine_impl.c. send_message_to_redis() in src/apps/relay/hiredis_libevent2.c then passes the attacker-controlled key as the format argument to redisAsyncCommand() while supplying only one variadic value, causing hiredis redisvFormatCommand() to read past the va_list. Exploitation can crash the coturn process and terminate active TURN sessions or disclose stack memory into Redis. This issue is fixed in version 4.13.0.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
coturn (PTS)bullseye4.5.2-3vulnerable
bookworm4.6.1-1vulnerable
trixie4.6.1-2vulnerable
forky, sid4.15.0-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
coturnsource(unstable)4.14.0-1

Notes

https://github.com/coturn/coturn/security/advisories/GHSA-4g7c-p5wg-j4hp
Fixed by: https://github.com/coturn/coturn/commit/8fa38032bb4751e11e072d65a8eca3c06c950979 (4.13.0)

Search for package or bug name: Reporting problems