Coturn: Prior to 4.15.0, an unauthenticated remote client can send a STUN message over TCP or TLS with a body-length field from 65520 through 65532, causing… (CVE-2026-68552)

Coturn, an open source TURN and STUN server implementation, has a vulnerability (CVE-2026-68552) in versions prior to 4.15.0 where an unauthenticated remote client can send a STUN message over TCP or TLS with a body-length field from 65520 through 65532. This causes the uint16_t len variable in the stun_get_message_len_str() function to wrap when STUN_HEADER_LENGTH is added. The framing layer then consumes only 4 to 16 bytes, treats the remaining bytes as another message, desynchronizes the stream parser, and drops the attacking client's connection. This denial-of-service condition affects only the attacking client connection and does not impact other clients or the server process. The vulnerability is resolved in Coturn version 4.15.0.

An unauthenticated remote attacker can cause a denial-of-service condition by sending a malformed STUN message that desynchronizes the stream parser and drops the attacker's own connection. There is no impact on other clients or the server process. The vulnerability does not allow for code execution, data disclosure, or privilege escalation.

Upgrade Coturn to version 4.15.0 or later, where this issue is fixed. No other mitigation is required as the vulnerability affects only the attacking client's connection and does not impact other clients or the server process.