Coturn: Prior to 4.13.0, an authenticated TURN user can place printf-style format specifiers in the STUN USERNAME or REALM attribute, which passes… (CVE-2026-68553)

Coturn, an open source TURN and STUN server, versions before 4.13.0 allow an authenticated TURN user to embed printf-style format specifiers in the STUN USERNAME or REALM attributes. These inputs pass is_secure_string() validation and are incorporated into Redis keys at multiple call sites in the source code. The function send_message_to_redis() then uses the attacker-controlled key as a format string argument to redisAsyncCommand() with only one variadic parameter, causing hiredis's redisvFormatCommand() to read beyond the va_list. This flaw can lead to a crash of the coturn process, terminating active TURN sessions, or disclosure of stack memory into Redis. The vulnerability is resolved in version 4.13.0.

Exploitation of this vulnerability can cause denial of service by crashing the coturn process and terminating active TURN sessions. Additionally, it can lead to partial disclosure of stack memory into Redis, potentially exposing sensitive information. The CVSS 3.1 score is 7.1 (medium severity) with network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, limited confidentiality impact, no integrity impact, and high availability impact.

Upgrade Coturn to version 4.13.0 or later, where this vulnerability is fixed. No other mitigation is indicated by the vendor advisory. Patch status is confirmed fixed in 4.13.0.