Coturn Project

14 CVEs across 1 Coturn Project products. Browse Coturn Project vulnerabilities, severities, and proof-of-concept exploits.

Coturn Project products with known CVEs

ProductCVEs
Coturn14
Coturn Project CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-53450High7.42026-07-10Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, coturn rejects loopback peers by default unless allow-loopback-peers is e…
CVE-2026-53449Medium6.02026-07-10Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, the psd print sessions dump CLI command in coturn takes a filename argume…
CVE-2026-53448High7.22026-07-10Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.12.0, the coturn HTTPS admin panel passes HTTP query parameters directly into S…
CVE-2026-43994High8.12026-06-18Coturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.10.0 contain a stack buffer overflow in decode_oauth_token_gcm(). A ui…
CVE-2026-43915Medium5.42026-06-18Coturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.11.0 contain a stored cross-site scripting (XSS) vulnerability in the…
CVE-2026-40613High7.52026-04-21Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.10.0, the STUN/TURN attribute parsing functions in coturn perform unsafe pointe…
CVE-2026-27624High7.22026-02-25Coturn is a free open source implementation of TURN and STUN Server. Coturn is commonly configured to block loopback and internal ranges using "denied-peer-ip"…
CVE-2020-26262High7.22021-01-13Coturn is free open source implementation of TURN and STUN Server. Coturn before version 4.5.2 by default does not allow peers to connect and relay packets to…
CVE-2020-4067High7.02020-06-29In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly. There is a leak of information between diffe…
CVE-2020-6062High7.52020-02-19An exploitable denial-of-service vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. A specially crafted HTTP POST request can lead…
CVE-2020-6061Critical9.82020-02-19An exploitable heap out-of-bounds read vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. A specially crafted HTTP POST request ca…
CVE-2018-4059Critical9.82019-03-21An exploitable unsafe default configuration vulnerability exists in the TURN server function of coTURN prior to version 4.5.0.9. By default, the TURN server ru…
CVE-2018-4058High7.72019-03-21An exploitable unsafe default configuration vulnerability exists in the TURN server functionality of coTURN prior to 4.5.0.9. By default, the TURN server allow…
CVE-2018-4056Critical9.82019-02-05An exploitable SQL injection vulnerability exists in the administrator web portal function of coTURN prior to version 4.5.0.9. A login message with a specially…