CVE-2026-68553

Received Received - Intake

Format String Vulnerability in Coturn TURN/STUN Server

Publication date: 2026-08-19

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, an authenticated TURN user can place printf-style format specifiers in the STUN USERNAME or REALM attribute, which passes is_secure_string() validation and is embedded into Redis keys at nine call sites in src/apps/relay/ns_ioalib_engine_impl.c. send_message_to_redis() in src/apps/relay/hiredis_libevent2.c then passes the attacker-controlled key as the format argument to redisAsyncCommand() while supplying only one variadic value, causing hiredis redisvFormatCommand() to read past the va_list. Exploitation can crash the coturn process and terminate active TURN sessions or disclose stack memory into Redis. This issue is fixed in version 4.13.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-20

Generated

2026-09-09

AI Q&A

2026-08-20

EPSS Evaluated

2026-09-07

NVD

CVE-2026-68553

Affected Vendors & Products

Vendor	Product	Version / Range
coturn	coturn	4.13.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-134	The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

Attack-Flow Graph

Executive Summary

This vulnerability in Coturn before 4.13.0 allows an authenticated TURN user to inject printf-style format specifiers into STUN USERNAME or REALM attributes. These inputs bypass validation and are used to create Redis keys. When Redis commands are executed, the attacker-controlled key is passed as a format string with insufficient arguments, causing hiredis to read beyond the provided data. This can crash the Coturn process or leak stack memory into Redis.

Detection Guidance

Detecting this vulnerability requires checking the Coturn server version. Run 'turnserver --version' to see if your version is below 4.13.0. If it is, the system is vulnerable. Additionally, monitor for crashes or Redis-related errors in logs.

Impact Analysis

An attacker could exploit this to crash your Coturn server, terminating active TURN sessions and disrupting services. They might also read sensitive memory contents, potentially exposing credentials or session data stored in memory.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by exposing stack memory in Redis, which may contain sensitive data. Unauthorized memory disclosure could lead to data breaches, violating GDPR's data protection principles or HIPAA's confidentiality requirements.

Mitigation Strategies

Upgrade Coturn to version 4.13.0 or later immediately. If upgrading is not possible, restrict access to the TURN server to trusted users only and disable Redis integration if enabled.

Hi! I’m here to help you understand CVE-2026-68553. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70