← Vulnerability feed

Vulnerability record · CVE-2026-40613 · published 21 April 2026

CVE-2026-40613: Coturn project coturn vulnerability

Coturn Project · Coturn

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.10.0, the STUN/TURN attribute parsing functions in coturn perform unsafe pointer casts from uint8_t * to uint16_t * without alignment checks. When processing a crafted STUN message with odd-aligned attribute boundaries, this results in misaligned memory reads at ns_turn_msg.c. On ARM64 architectures (AArch64) with strict alignment enforcement, this causes a SIGBUS signal that immediately kills the turnserver process. An unauthenticated remote attacker can crash any ARM64 coturn deployment by sending a single crafted UDP packet. This vulnerability is fixed in 4.10.0.

7.5 CVSS 3.1 High EPSS 1.5% · top 26.4% CWE-704 · CWE-704
7.5CVSS 3.1 base score
1.5%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.10.0, the STUN/TURN attribute parsing functions in coturn perform unsafe pointer casts from uint8_t * to uint16_t * without alignment checks. When processing a crafted STUN message with odd-aligned attribute boundaries, this results in misaligned memory reads at ns_turn_msg.c. On ARM64 architectures (AArch64) with strict alignment enforcement, this causes a SIGBUS signal that immediately kills the turnserver process. An unauthenticated remote attacker can crash any ARM64 coturn deployment by sending a single crafted UDP packet. This vulnerability is fixed in 4.10.0.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/coturn/coturn/security/advisories/GHSA-j662-9wcj-mf36 ExploitVendor Advisory
https://github.com/coturn/coturn/security/advisories/GHSA-j662-9wcj-mf36 ExploitVendor Advisory

Track CVE-2026-40613 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-43994Coturn project coturn classic buffer overflow vulnerabilityCoturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.10.0 contain a stack buffer overflow in decode_oauth_token_g…EPSS 0.68%9.8CVE-2020-6061Coturn project coturn out-of-bounds read vulnerabilityAn exploitable heap out-of-bounds read vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. A specially crafted HTTP POST …EPSS 5.1%9.8CVE-2018-4059Coturn project coturn missing authorization vulnerabilityAn exploitable unsafe default configuration vulnerability exists in the TURN server function of coTURN prior to version 4.5.0.9. By default, the TURN…EPSS 1.9%9.8CVE-2018-4056Coturn project coturn sql injection vulnerabilityAn exploitable SQL injection vulnerability exists in the administrator web portal function of coTURN prior to version 4.5.0.9. A login message with a…EPSS 3.0%7.7CVE-2018-4058Coturn project coturn vulnerabilityAn exploitable unsafe default configuration vulnerability exists in the TURN server functionality of coTURN prior to 4.5.0.9. By default, the TURN se…EPSS 0.92%7.5CVE-2020-4067Coturn project coturn vulnerabilityIn coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly. There is a leak of information bet…EPSS 1.9%7.5CVE-2020-6062Coturn project coturn null pointer dereference vulnerabilityAn exploitable denial-of-service vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. A specially crafted HTTP POST reques…EPSS 6.1%7.4CVE-2026-53450Coturn project coturn server-side request forgery (ssrf) vulnerabilityCoturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, coturn rejects loopback peers by default unless allow-loopback-…EPSS 0.29%

Source: NIST National Vulnerability Database (record CVE-2026-40613), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.