coturn: Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote unauthenticated attackers...
CVE-2026-104074 is fixed in coturn on 1 platform by DEBIAN-CVE-2026-104074 (version 4.12.0-1), released October 10, 2026. It is not reported as exploited. Patch Radar priority: Routine.
Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote unauthenticated attackers to leak stack memory contents by sending a TURN Allocate request without credentials. Attackers can exploit the stun_init_error_response_common_str() function in src/client/ns_turn_msg.c, which fails to zero-initialize the avalue buffer before computing its length with strlen() and copying leaked stack bytes into the ERROR-CODE reason phrase, exposing pointer fragments that weaken ASLR and enable precise version fingerprinting.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| coturn · Debian 14 | 4.12.0-1 | DEBIAN-CVE-2026-104074 | Oct 10, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.