Description

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, an authenticated TURN user can place printf-style format specifiers in the STUN USERNAME or REALM attribute, which passes is_secure_string() validation and is embedded into Redis keys at nine call sites in src/apps/relay/ns_ioalib_engine_impl.c. send_message_to_redis() in src/apps/relay/hiredis_libevent2.c then passes the attacker-controlled key as the format argument to redisAsyncCommand() while supplying only one variadic value, causing hiredis redisvFormatCommand() to read past the va_list. Exploitation can crash the coturn process and terminate active TURN sessions or disclose stack memory into Redis. This issue is fixed in version 4.13.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-19T21:17:28.163Z",
  "pubdate": "2026-08-19T21:17:28.163Z",
  "executiveSummary": "A format string vulnerability exists in Coturn prior to version 4.13.0, allowing authenticated TURN users to inject printf-style format specifiers via the STUN USERNAME or REALM attribute.\nThe vulnerability affects Coturn implementations utilizing Redis backend integration for state management and request handling.\nExploitation of this flaw enables an authenticated attacker to trigger a denial of service by crashing the coturn process, effectively terminating all active TURN sessions.\nAdditionally, exploitation can lead to unauthorized stack memory disclosure, leaking sensitive data directly into Redis keys.\nThe attack requires authentication as a valid TURN user, but no specialized privileges beyond standard user access are necessary.\nRisk implications are significant for environments relying on Coturn for real-time communications infrastructure, particularly when integrated with Redis services.",
  "technicalDetails": "The root cause of the vulnerability is improper handling of user-supplied input within Redis key construction logic, specifically failing to sanitize format specifiers before passing them to logging or formatting routines.\nVulnerable components reside in src/apps/relay/ns_ioalib_engine_impl.c, where nine call sites embed input into Redis keys after it successfully passes is_secure_string() validation.\nThe attack flow begins when an authenticated TURN user crafts a malicious STUN packet containing printf-style format specifiers within the STUN USERNAME or REALM attribute.\nThis crafted input bypasses the is_secure_string() validation checks and is subsequently passed to the send_message_to_redis() function located in src/apps/relay/hiredis_libevent2.c.\nThe send_message_to_redis() function takes the attacker-controlled key and directly passes it as the format argument to redisAsyncCommand().\nBecause the function supplies only a single variadic value alongside the format argument, hiredis redisvFormatCommand() attempts to process non-existent subsequent arguments, causing it to read past the boundaries of the va_list.\nThis out-of-bounds read results in undefined behavior, causing either process termination and denial of service or the unintended disclosure of stack memory contents stored within the generated Redis keys.\nAffected versions include all Coturn releases prior to version 4.13.0.\nAuthentication requirements dictate that the attacker must be a valid TURN user to supply the malicious STUN attributes, although no administrative privileges are required.\nNetwork exposure is inherent to the service, as Coturn instances must accept STUN/TURN traffic from authenticated clients to perform their core relay functions."
}