CVE-2026-62959 coturn CVE debrief

Who should care

Administrators and users of Coturn servers, especially those exposing plaintext-TCP listeners, should be aware of this vulnerability and take necessary actions to mitigate it. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Additionally, they should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed and check relevant monitoring, detection, and logs for exposed assets that need extra review.

Technical summary

The Coturn server is vulnerable to a heap memory exposure issue when started with --acme-redirect <URL> and exposing a plaintext-TCP listener. An unauthenticated remote client can send a single ordinary HTTP GET request and receive a 301 response whose Location header contains up to ~870 bytes of adjacent process heap memory. The leaked region is a recycled network receive buffer that is reused without being zeroed, so on a busy server it can contain data from other clients' requests (TURN credentials, OAuth tokens, relayed payloads). Root cause is a signed→unsigned conversion. This issue is fixed in version 4.15.0. To mitigate, administrators should apply the patch and restrict access to the Coturn server.

Defensive priority

High-priority defensive actions are required due to the high CVSS score of 8.2 and the potential for significant data exposure.

Recommended defensive actions

• Apply the patch from version 4.15.0
• Restrict access to the Coturn server
• Monitor for suspicious HTTP GET requests
• Consider implementing additional security measures
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Evidence is based on official CVE and NVD records, as well as source references from GitHub. However, details about the vulnerability's impact and affected systems are limited. The Coturn server's heap memory exposure issue arises when started with --acme-redirect <URL> and exposing a plaintext-TCP listener. An unauthenticated remote client can send a single ordinary HTTP GET request and receive a 301 response whose Location header contains up to ~870 bytes of adjacent process heap memory. This memory can contain data from other clients' requests, including TURN credentials, OAuth tokens, and relayed payloads. The root cause is a signed→unsigned conversion. To verify and mitigate, defenders should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also check relevant monitoring, detection, and logs for exposed assets that need extra review.

Official resources