Description

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an unauthenticated remote client can send a STUN message over TCP or TLS with a body-length field from 65520 through 65532, causing the uint16_t len variable in stun_get_message_len_str() in src/client/ns_turn_msg.c to wrap when STUN_HEADER_LENGTH is added. The framing layer then consumes only 4 through 16 bytes, treats the remaining bytes as another message, desynchronizes the stream parser, and drops the attacking client's connection. Other clients and the server process are not affected. This issue is fixed in version 4.15.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-19T21:17:28.017Z",
  "pubdate": "2026-08-19T21:17:28.017Z",
  "executiveSummary": "A numeric range validation flaw exists in Coturn prior to version 4.15.0, specifically within the STUN message parsing logic.\nThe vulnerability allows an unauthenticated remote client communicating over TCP or TLS to trigger an integer wrap by supplying a carefully crafted body-length field in a STUN message.\nUpon successful exploitation, the framing layer miscalculates message boundaries, consumes a fraction of the expected bytes, and desynchronizes the stream parser, leading to the termination of the attacking client's connection.\nWhile other concurrent clients and the core server process remain unaffected and operational, the condition represents a denial-of-service vector specifically targeted at the stream parser handling the malicious connection.\nAttackers require network access to the Coturn server over TCP or TLS but do not need authentication or elevated privileges to execute the attack.",
  "technicalDetails": "The root cause of the vulnerability resides in the function stun_get_message_len_str() located in src/client/ns_turn_msg.c.\nWhen processing incoming STUN messages over TCP or TLS transport layers, the parser extracts a body-length field from the message header.\nIn affected versions prior to 4.15.0, supplying an unauthenticated remote payload with a body-length field ranging from 65520 through 65532 causes the uint16_t len variable to integer wrap when STUN_HEADER_LENGTH is added to the calculation.\nBecause of this integer wrap, the framing layer incorrectly determines the size of the incoming data block, consuming only 4 through 16 bytes of the actual payload.\nThe protocol parser then improperly treats the remaining unconsumed bytes as the start of a subsequent STUN message, resulting in complete desynchronization of the stream parser state machine.\nFollowing this state desynchronization, the server drops the attacking client's connection, achieving a localized denial-of-service against that specific session.\nThe vulnerability is exposed over the network via TCP or TLS listeners implemented by the Coturn server, requiring zero authentication or prior privileges from the remote attacker."
}