CVE-2026-68552

Name of the Vulnerable Software and Affected Versions Coturn versions prior to 4.15.0

Description An unauthenticated remote client can send a STUN message over TCP or TLS with a body-length field between 65520 and 65532. This causes the len variable in the stun get message len str() function to wrap when the STUN HEADER LENGTH is added. Consequently, the framing layer consumes only 4 to 16 bytes and treats the remaining data as a separate message, which desynchronizes the stream parser and results in the connection of the attacking client being dropped. Other clients and the server process remain unaffected.

Recommendations Update to version 4.15.0.