← Vulnerability feed

Vulnerability record · CVE-2018-4058 · published 21 March 2019

CVE-2018-4058: Coturn project coturn vulnerability

Coturn Project · Coturn

An exploitable unsafe default configuration vulnerability exists in the TURN server functionality of coTURN prior to 4.5.0.9. By default, the TURN server allows relaying external traffic to the loopback interface of its own host. This can provide access to other private services running on that host, which can lead to further attacks. An attacker can set up a relay with a loopback address as the peer on an affected TURN server to trigger this vulnerability.

7.7 CVSS 3.1 High EPSS 0.92% · top 41.4%
7.7CVSS 3.1 base score, v2 4.0
0.92%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

An exploitable unsafe default configuration vulnerability exists in the TURN server functionality of coTURN prior to 4.5.0.9. By default, the TURN server allows relaying external traffic to the loopback interface of its own host. This can provide access to other private services running on that host, which can lead to further attacks. An attacker can set up a relay with a loopback address as the peer on an affected TURN server to trigger this vulnerability.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://talosintelligence.com/vulnerability_reports/TALOS-2018-0732 MitigationThird Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2018-0732 MitigationThird Party Advisory

Track CVE-2018-4058 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-43994Coturn project coturn classic buffer overflow vulnerabilityCoturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.10.0 contain a stack buffer overflow in decode_oauth_token_g…EPSS 0.68%9.8CVE-2020-6061Coturn project coturn out-of-bounds read vulnerabilityAn exploitable heap out-of-bounds read vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. A specially crafted HTTP POST …EPSS 5.1%9.8CVE-2018-4059Coturn project coturn missing authorization vulnerabilityAn exploitable unsafe default configuration vulnerability exists in the TURN server function of coTURN prior to version 4.5.0.9. By default, the TURN…EPSS 1.9%9.8CVE-2018-4056Coturn project coturn sql injection vulnerabilityAn exploitable SQL injection vulnerability exists in the administrator web portal function of coTURN prior to version 4.5.0.9. A login message with a…EPSS 3.0%7.5CVE-2026-40613Coturn project coturn vulnerabilityCoturn is a free open source implementation of TURN and STUN Server. Prior to 4.10.0, the STUN/TURN attribute parsing functions in coturn perform uns…EPSS 1.5%7.5CVE-2020-4067Coturn project coturn vulnerabilityIn coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly. There is a leak of information bet…EPSS 1.9%7.5CVE-2020-6062Coturn project coturn null pointer dereference vulnerabilityAn exploitable denial-of-service vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. A specially crafted HTTP POST reques…EPSS 6.1%7.4CVE-2026-53450Coturn project coturn server-side request forgery (ssrf) vulnerabilityCoturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, coturn rejects loopback peers by default unless allow-loopback-…EPSS 0.29%

Source: NIST National Vulnerability Database (record CVE-2018-4058), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.