These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
Coturn is a free open source implementation of TURN and STUN Server. In 4.15.0, an authenticated TURN user can repeatedly resume one allocation from fresh UDP 5-tuples without completing a handoff when the server enables --mobility. mobile_begin_transition() in src/server/ns_turn_server.c disarms each new session's allocation timeout and overwrites the allocation's single mobile_pending_resume link, leavi [truncated]
The Coturn implementation of TURN and STUN Server is vulnerable to an on-path attack, allowing an attacker to append attributes to an authenticated STUN request on plain UDP or TCP. This issue is fixed in version 4.15.0. Affected product deployments should be identified and verified for exposure, with owners assigned for follow-up. The vulnerability allows for potential modification of allocation lifetime [truncated]
The Coturn implementation of TURN and STUN Server is vulnerable to a format specifier injection attack. An authenticated TURN user can inject printf-style format specifiers into the STUN USERNAME or REALM attribute, which is then embedded into Redis keys. This can cause the hiredis redisvFormatCommand() to read past the va_list, potentially crashing the coturn process or disclosing stack memory into Redis [truncated]
The Coturn implementation of TURN and STUN Server is vulnerable to a denial of service attack. An unauthenticated remote client can send a STUN message over TCP or TLS with a body-length field from 65520 through 65532, causing the uint16_t len variable in stun_get_message_len_str() to wrap when STUN_HEADER_LENGTH is added. This leads to desynchronization of the stream parser and dropping of the attacking [truncated]
CVE-2026-73216 is a medium-severity vulnerability in Coturn, a free open-source implementation of TURN and STUN Server. The issue allows an authenticated client to bypass user and total quotas, potentially exhausting relay ports. This problem was fixed in version 4.17.0. System administrators and security teams should assess their exposure, especially in mobility-enabled allocations, and ensure timely rem [truncated]
CVE-2026-73215 is a high-severity vulnerability in Coturn, a free open-source implementation of TURN and STUN Server. An authenticated client can exploit this issue to permanently exhaust the relay port pool, causing subsequent allocations to fail with STUN error 508. The vulnerability is fixed in version 4.17.0. Coturn administrators should assess exposure and prioritize patching to prevent authenticated [truncated]
CVE-2026-73214 is a high-severity vulnerability in Coturn, a free open-source implementation of TURN and STUN Server. The vulnerability allows an unauthenticated remote sender to exhaust memory by sending a specially crafted 35-byte fragmented ClientHello message, declaring a 650,000-byte handshake before cookie validation. This issue is fixed in version 4.16.0.
CVE-2026-73213 is a medium-severity vulnerability in Coturn, a free open-source implementation of TURN and STUN Server. The issue allows an authenticated TURN client to relay to an IPv6 peer that is numerically within a configured non-prefix-aligned denied-peer-ip range but is classified as outside it. This vulnerability is fixed in version 4.16.0.
CVE-2026-73212 is a medium-severity vulnerability in Coturn, a free open-source implementation of TURN and STUN Server. The issue allows an authenticated RFC 6062 TCP CONNECT relay client to bypass an IPv4 denied-peer-ip range when the Coturn host has a useful translation route. This occurs because the good_peer_addr() function in src/server/ns_turn_server.c uses ioa_addr_in_range() in src/client/ns_turn_ [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-31T21:17:31.857Z and has not been modified since then. Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, a server using --mobility authenticates a resumed REFRESH request with the resuming user's credentials but does not verify that identity against the original a [truncated]
The Coturn server, a free open source implementation of TURN and STUN Server, is vulnerable to a heap memory exposure issue. When Coturn is started with --acme-redirect <URL> and exposes a plaintext-TCP listener, an unauthenticated remote client can send a single ordinary HTTP GET request and receive a 301 response whose Location header contains up to ~870 bytes of adjacent process heap memory. The leaked [truncated]
The Coturn implementation of TURN and STUN Server is vulnerable to a loopback bypass issue. Prior to version 4.13.0, the default loopback guard can be circumvented by using the IPv4-mapped IPv6 peer address ::ffff:127.0.0.1 in a TURN XOR-PEER-ADDRESS attribute. This allows an authenticated TURN client to expose services bound only to localhost on the Coturn host through TURN relay traffic. The vulnerabili [truncated]
The Coturn implementation of TURN and STUN Server is vulnerable to arbitrary file write via the psd print sessions dump CLI command. Prior to version 4.13.0, an authenticated admin with CLI access can directly pass a filename argument to fopen with no path validation, allowing truncation and overwrite with session dump data. This issue affects Coturn versions prior to 4.13.0 and can be mitigated by upgrad [truncated]
The Coturn implementation of TURN and STUN Server is vulnerable to SQL injection via the HTTPS admin panel. Prior to version 4.12.0, the admin panel passes HTTP query parameters directly into SQL queries without sanitization, allowing an authenticated admin to inject arbitrary SQL. This could lead to full database control and potentially OS-level access via PostgreSQL COPY TO PROGRAM. The issue is fixed i [truncated]
Coturn, a free open-source implementation of TURN and STUN Server, is vulnerable to a stack buffer overflow in decode_oauth_token_gcm(). This issue allows an attacker to write up to 735 bytes of controlled data past a 256-byte stack buffer, potentially corrupting adjacent stack data, including control-flow data. The vulnerability exists in versions prior to 4.10.0 and is exploitable in --oauth mode, which [truncated]
Coturn, a free open-source implementation of TURN and STUN Server, has a stored cross-site scripting (XSS) vulnerability in its web-admin HTTPS interface. An attacker can create a TURN allocation with a crafted USERNAME value to inject HTML/JavaScript that executes when an authenticated web-admin user views the TURN session list. This issue may be exploitable without TURN credentials in configurations usi [truncated]