Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote unauthenticated attackers to leak stack memory contents… (CVE-2026-104074)

Coturn 4.10.0 has an uninitialized memory disclosure vulnerability (CVE-2026-104074) exploitable by remote unauthenticated attackers. The flaw exists in the stun_init_error_response_common_str() function in src/client/ns_turn_msg.c, which does not zero-initialize the avalue buffer before computing its length and copying it into the ERROR-CODE reason phrase. This leads to leakage of stack memory contents, including pointer fragments that can weaken ASLR protections and facilitate version fingerprinting. The vulnerability is triggered by sending a TURN Allocate request without credentials.

The vulnerability allows remote unauthenticated attackers to leak stack memory contents, which can expose pointer fragments. This information leakage can weaken ASLR, potentially aiding attackers in bypassing memory protection mechanisms and enabling precise fingerprinting of the Coturn version. There is no direct impact on integrity or availability reported. The CVSS score of 5.3 reflects a medium impact primarily due to confidentiality loss.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, consider restricting access to TURN Allocate requests or implementing additional network-level controls to limit exposure. Monitor vendor advisories for updates on remediation.