CVE-2026-68553

Name of the Vulnerable Software and Affected Versions Coturn versions prior to 4.13.0

Description An authenticated TURN user can introduce printf-style format specifiers into the STUN USERNAME or REALM attributes. These attributes bypass is secure string() validation and are embedded into Redis keys within src/apps/relay/ns ioalib engine impl.c. Subsequently, the send message to redis() function in src/apps/relay/hiredis libevent2.c uses the attacker-controlled key as the format argument for redisAsyncCommand(). Because only one variadic value is supplied, the redisvFormatCommand() function in hiredis reads past the va list (a variable argument list). This can lead to a process crash, termination of active TURN sessions, or the disclosure of stack memory into Redis.

Recommendations Update to version 4.13.0.