Memory Disclosure in Coturn STUN/TURN Server

Executive Summary

CVE-2026-104074 is an uninitialized memory disclosure vulnerability in Coturn 4.10.0. Remote unauthenticated attackers can exploit it by sending a TURN Allocate request without credentials. The vulnerability occurs in the stun_init_error_response_common_str() function, which fails to zero-initialize a buffer before using strlen() and copying stack memory contents into an ERROR-CODE reason phrase. This exposes pointer fragments that weaken ASLR and enable version fingerprinting.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking Coturn server version and monitoring for unusual memory leaks or stack disclosures. Verify if your Coturn version is below 4.11.0. Use commands like 'turnserver --version' to check the installed version. Monitor logs for ERROR-CODE responses containing unexpected data or stack traces.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to leak sensitive stack memory, including pointers that weaken ASLR protections. This may allow further exploitation of other vulnerabilities or aid in precise version fingerprinting to target specific Coturn deployments. The impact is primarily on confidentiality and system integrity.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability exposes stack memory contents, which could lead to unauthorized data disclosure. For GDPR, this may violate principles of data confidentiality and integrity. For HIPAA, it risks exposing protected health information if exploited in healthcare environments.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Coturn to version 4.11.0 or later immediately. Disable unauthenticated TURN Allocate requests if possible. Apply network-level restrictions to block suspicious STUN/TURN traffic. Review and update firewall rules to limit exposure of the Coturn service ports.

Useful 0 Not Useful 0