From 4.5.2 through 4.14.0, when Coturn is started with --acme-redirect <URL> and exposes a plaintext-TCP listener, an unauthenticated remote client… (CVE-2026-62959)

Coturn, an open source TURN and STUN server, has a vulnerability in versions 4.5.2 through 4.14.0 when configured with --acme-redirect <URL> and a plaintext-TCP listener. An unauthenticated remote attacker can send a single HTTP GET request and receive a 301 redirect response whose Location header contains up to ~870 bytes of adjacent heap memory. This memory is a recycled network receive buffer reused without zeroing, potentially exposing sensitive client data such as TURN credentials and OAuth tokens. The root cause is a signed to unsigned integer conversion error. The vulnerability is fixed in version 4.15.0.

An unauthenticated remote attacker can leak sensitive memory contents from the Coturn process heap, potentially exposing TURN credentials, OAuth tokens, and relayed payload data from other clients. This could lead to unauthorized access or information disclosure. The vulnerability requires the server to be started with --acme-redirect and expose a plaintext-TCP listener. No known exploits in the wild have been reported.

Upgrade Coturn to version 4.15.0 or later, where this vulnerability is fixed. Until then, avoid starting Coturn with the --acme-redirect option combined with a plaintext-TCP listener to prevent memory leakage. No other vendor advisories or temporary fixes are provided.