Homepage

Integer Overflow or Wraparound Affecting coturn package, versions <4.15.0-1

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.32% (25th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIANUNSTABLE-COTURN-19166278
  • published22 Aug 2026
  • disclosed19 Aug 2026
Report a new vulnerability Found a mistake?

Introduced: 19 Aug 2026

NewCVE-2026-68552  (opens in a new tab)
CWE-190  (opens in a new tab)

How to fix?

Upgrade Debian:unstable coturn to version 4.15.0-1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream coturn package and not the coturn package as distributed by Debian. See How to fix? for Debian:unstable relevant fixed versions and status.

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an unauthenticated remote client can send a STUN message over TCP or TLS with a body-length field from 65520 through 65532, causing the uint16_t len variable in stun_get_message_len_str() in src/client/ns_turn_msg.c to wrap when STUN_HEADER_LENGTH is added. The framing layer then consumes only 4 through 16 bytes, treats the remaining bytes as another message, desynchronizes the stream parser, and drops the attacking client's connection. Other clients and the server process are not affected. This issue is fixed in version 4.15.0.