CVE-2026-68552

MediumCVSS 5.3/10Last modified Sep 9, 2026

Description

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an unauthenticated remote client can send a STUN message over TCP or TLS with a body-length field from 65520 through 65532, causing the uint16_t len variable in stun_get_message_len_str() in src/client/ns_turn_msg.c to wrap when STUN_HEADER_LENGTH is added. The framing layer then consumes only 4 through 16 bytes, treats the remaining bytes as another message, desynchronizes the stream parser, and drops the attacking client's connection. Other clients and the server process are not affected. This issue is fixed in version 4.15.0.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-190

Affected software

No affected versions have been published.

Timeline

Published
Aug 19, 2026
Last modified
Sep 9, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-685537.1Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, an authenticated TURN user can place printf-style formCVE-2026-685542.3Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an on-path attacker can append attributes after MESSAGCVE-2026-685556.5Coturn is a free open source implementation of TURN and STUN Server. In 4.15.0, an authenticated TURN user can repeatedly resume one allocatCVE-2026-685588.5Wekan is open source kanban built with Meteor. From 8.36 until 9.74, the outgoing webhook Integration URL validator in models/integrations.jCVE-2026-685596.5Wekan is open source kanban built with Meteor. From 9.57 until 9.74, the /api/boards/:boardId/exportExcel route in models/exportExcel.js calCVE-2026-685607.7Wekan is open source kanban built with Meteor. Prior to 9.75, models/fileValidation.js interpolated the uploaded fileObj.path into the adminCVE-2026-685618.8Wekan is open source kanban built with Meteor. Prior to 9.89, the second Boards.allow({ update }) rule in server/permissions/boards.js calleCVE-2026-685626.2A flaw was found in ansible-collection-redhat-leapp. An attacker with privileged write access to a managed node's Leapp report content can mCVE-2026-685635.5A flaw was found in ansible-collection-redhat-leapp. When a remediation task is executed with elevated privileges and the `leapp_old_postgreCVE-2026-685647.1Unauthenticated Cross Site Scripting (XSS) in NotificationX Pro <= 3.1.4 versions.CVE-2026-685656.5Contributor Cross Site Scripting (XSS) in GeoDirectory <= 2.8.172 versions.CVE-2026-685669.3Unauthenticated SQL Injection in BookingPress Appointment Booking Pro <= 6.0.2 versions.