CVE-2026-68553 coturn CVE debrief

Who should care

System administrators and security teams responsible for Coturn servers should assess their exposure and take necessary actions to mitigate the vulnerability. This includes reviewing and updating Coturn to version 4.13.0 or later, restricting access to the Coturn server to only trusted users, and monitoring Coturn server logs for suspicious activity. Additionally, security teams should consider implementing additional security measures such as input 4

Why it matters

CVE-2026-68553 is a high-severity vulnerability in the Coturn implementation of TURN and STUN Server. An authenticated TURN user can inject format specifiers into the STUN USERNAME or REALM attribute, potentially crashing the Coturn process or disclosing stack memory into Redis. System administrators and security teams responsible for Coturn servers should assess their exposure and take necessary actions to mitigate the vulnerability.

• Potential crash of Coturn process
• Potential disclosure of stack memory into Redis
• Need to verify and update Coturn to version 4.13.0 or later
• Need to restrict access to the Coturn server to only trusted users

Technical summary

The Coturn implementation of TURN and STUN Server is vulnerable to a format specifier injection attack. An authenticated TURN user can inject printf-style format specifiers into the STUN USERNAME or REALM attribute, which is then embedded into Redis keys. This can cause the hiredis redisvFormatCommand() to read past the va_list, potentially crashing the coturn process or disclosing stack memory into Redis.

Defensive priority

High

Recommended defensive actions

• Review and update Coturn to version 4.13.0 or later
• Restrict access to the Coturn server to only trusted users
• Monitor Coturn server logs for suspicious activity
• Consider implementing additional security measures such as input validation and sanitization
• Perform a thorough review of Coturn server configurations and ensure that all necessary security patches are applied
• Verify that Coturn server access controls are in place and functioning correctly
• Conduct regular security audits to identify and address potential vulnerabilities

Evidence notes

The Coturn implementation of TURN and STUN Server is vulnerable to a format specifier injection attack. An authenticated TURN user can inject printf-style format specifiers into the STUN USERNAME or REALM attribute, which is then embedded into Redis keys. This can cause the hiredis redisvFormatCommand() to read past the va_list, potentially crashing the coturn process or disclosing stack memory into Redis.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.