CVE-2026-62959
Received Received - Intake

Heap Memory Leak in Coturn STUN/TURN Server

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: GitHub, Inc.

Description
Coturn is a free open source implementation of TURN and STUN Server. From 4.5.2 through 4.14.0, when Coturn is started with --acme-redirect <URL> and exposes a plaintext-TCP listener, an unauthenticated remote client can send a single ordinary HTTP GET request and receive a 301 response whose Location header contains up to ~870 bytes of adjacent process heap memory. The leaked region is a recycled network receive buffer that is reused without being zeroed, so on a busy server it can contain data from other clients' requests (TURN credentials, OAuth tokens, relayed payloads). Root cause is a signed→unsigned conversion. This issue is fixed in version 4.15.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-31
Last Modified
2026-07-31
Generated
2026-08-01
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-62959
EUVD
EUVD-2026-51627

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
coturn coturn From 4.5.2 (inc) to 4.14.0 (inc)
coturn coturn 4.15.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.
CWE-195 The product uses a signed primitive and performs a cast to an unsigned primitive, which can produce an unexpected value if the value of the signed primitive can not be represented using an unsigned primitive.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-62959 is a vulnerability in Coturn, a TURN and STUN server, affecting versions 4.5.2 through 4.14.0. When Coturn is started with the --acme-redirect flag and a plaintext-TCP listener is exposed, an unauthenticated remote client can send a single HTTP GET request and receive a 301 response. The Location header in this response may leak up to 870 bytes of adjacent process heap memory, which could contain sensitive data like TURN credentials or OAuth tokens from other clients.

Detection Guidance

To detect this vulnerability, check if your Coturn server is running a version between 4.5.2 and 4.14.0 with the --acme-redirect flag enabled. Inspect network traffic for HTTP 301 responses containing unexpected data in the Location header. Use tools like tcpdump or Wireshark to capture and analyze TCP traffic on the Coturn server's plaintext listener port.

Impact Analysis

This vulnerability allows attackers to extract sensitive information from the server's memory, including credentials or tokens of other users. If exploited, it could lead to unauthorized access to services, data breaches, or further attacks on the system. Servers running affected versions are at risk if the --acme-redirect flag is used.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Organizations may face legal penalties, reputational damage, and loss of trust if sensitive data is leaked due to this issue.

Mitigation Strategies

Upgrade Coturn to version 4.15.0 or later immediately. If upgrading is not possible, disable the --acme-redirect feature and restart the service. Ensure no plaintext-TCP listeners are exposed to untrusted networks. Review logs for suspicious HTTP requests and rotate any exposed credentials or tokens.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62959. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart