CVE-2026-62959

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-62959", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-14T22:32:17.732Z", "datePublished": "2026-07-31T19:57:06.394Z", "dateUpdated": "2026-07-31T23:34:33.361Z"}, "containers": {"cna": {"title": "Coturn: Pre-authentication heap memory disclosure in ACME redirect (`try_acme_redirect`)", "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "lang": "en", "description": "CWE-125: Out-of-bounds Read", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-195", "lang": "en", "description": "CWE-195: Signed to Unsigned Conversion Error", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/coturn/coturn/security/advisories/GHSA-m23x-5qf5-988g", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/coturn/coturn/security/advisories/GHSA-m23x-5qf5-988g"}, {"name": "https://github.com/coturn/coturn/pull/1965", "tags": ["x_refsource_MISC"], "url": "https://github.com/coturn/coturn/pull/1965"}, {"name": "https://github.com/coturn/coturn/commit/960835886692fa04cf63ddd970c3f330740c87f4", "tags": ["x_refsource_MISC"], "url": "https://github.com/coturn/coturn/commit/960835886692fa04cf63ddd970c3f330740c87f4"}, {"name": "https://github.com/coturn/coturn/releases/tag/4.15.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/coturn/coturn/releases/tag/4.15.0"}], "affected": [{"vendor": "coturn", "product": "coturn", "versions": [{"version": ">= 4.5.2, < 4.15.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-31T19:57:06.394Z"}, "descriptions": [{"lang": "en", "value": "Coturn is a free open source implementation of TURN and STUN Server. From 4.5.2 through 4.14.0, when Coturn is started with --acme-redirect <URL> and exposes a plaintext-TCP listener, an unauthenticated remote client can send a single ordinary HTTP GET request and receive a 301 response whose Location header contains up to ~870 bytes of adjacent process heap memory. The leaked region is a recycled network receive buffer that is reused without being zeroed, so on a busy server it can contain data from other clients' requests (TURN credentials, OAuth tokens, relayed payloads). Root cause is a signed\u2192unsigned conversion. This issue is fixed in version 4.15.0."}], "source": {"advisory": "GHSA-m23x-5qf5-988g", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/coturn/coturn/security/advisories/GHSA-m23x-5qf5-988g", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-31T23:34:10.861030Z", "id": "CVE-2026-62959", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-31T23:34:33.361Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-62959", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-31T23:34:10.861030Z"}}}], "references": [{"url": "https://github.com/coturn/coturn/security/advisories/GHSA-m23x-5qf5-988g", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-31T23:34:29.009Z"}}], "cna": {"title": "Coturn: Pre-authentication heap memory disclosure in ACME redirect (`try_acme_redirect`)", "source": {"advisory": "GHSA-m23x-5qf5-988g", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "coturn", "product": "coturn", "versions": [{"status": "affected", "version": ">= 4.5.2, < 4.15.0"}]}], "references": [{"url": "https://github.com/coturn/coturn/security/advisories/GHSA-m23x-5qf5-988g", "name": "https://github.com/coturn/coturn/security/advisories/GHSA-m23x-5qf5-988g", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/coturn/coturn/pull/1965", "name": "https://github.com/coturn/coturn/pull/1965", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/coturn/coturn/commit/960835886692fa04cf63ddd970c3f330740c87f4", "name": "https://github.com/coturn/coturn/commit/960835886692fa04cf63ddd970c3f330740c87f4", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/coturn/coturn/releases/tag/4.15.0", "name": "https://github.com/coturn/coturn/releases/tag/4.15.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Coturn is a free open source implementation of TURN and STUN Server. From 4.5.2 through 4.14.0, when Coturn is started with --acme-redirect <URL> and exposes a plaintext-TCP listener, an unauthenticated remote client can send a single ordinary HTTP GET request and receive a 301 response whose Location header contains up to ~870 bytes of adjacent process heap memory. The leaked region is a recycled network receive buffer that is reused without being zeroed, so on a busy server it can contain data from other clients' requests (TURN credentials, OAuth tokens, relayed payloads). Root cause is a signed\u2192unsigned conversion. This issue is fixed in version 4.15.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125: Out-of-bounds Read"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-195", "description": "CWE-195: Signed to Unsigned Conversion Error"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-31T19:57:06.394Z"}}}, "cveMetadata": {"cveId": "CVE-2026-62959", "state": "PUBLISHED", "dateUpdated": "2026-07-31T23:34:33.361Z", "dateReserved": "2026-07-14T22:32:17.732Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-31T19:57:06.394Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "coturn", "vendor": "coturn", "versions": [{"status": "affected", "version": ">= 4.5.2, < 4.15.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Coturn is a free open source implementation of TURN and STUN Server. From 4.5.2 through 4.14.0, when Coturn is started with --acme-redirect <URL> and exposes a plaintext-TCP listener, an unauthenticated remote client can send a single ordinary HTTP GET request and receive a 301 response whose Location header contains up to ~870 bytes of adjacent process heap memory. The leaked region is a recycled network receive buffer that is reused without being zeroed, so on a busy server it can contain data from other clients' requests (TURN credentials, OAuth tokens, relayed payloads). Root cause is a signed\u2192unsigned conversion. This issue is fixed in version 4.15.0."}], "id": "CVE-2026-62959", "lastModified": "2026-09-09T20:55:04.493", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-62959", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-31T23:34:10.861030Z", "version": "2.0.3"}}]}, "published": "2026-07-31T20:16:53.357", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/coturn/coturn/commit/960835886692fa04cf63ddd970c3f330740c87f4"}, {"source": "security-advisories@github.com", "url": "https://github.com/coturn/coturn/pull/1965"}, {"source": "security-advisories@github.com", "url": "https://github.com/coturn/coturn/releases/tag/4.15.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/coturn/coturn/security/advisories/GHSA-m23x-5qf5-988g"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/coturn/coturn/security/advisories/GHSA-m23x-5qf5-988g"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-195"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "coturn: Coturn: Pre-authentication heap memory disclosure", "id": "2509924", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509924"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-908", "details": ["Coturn is a free open source implementation of TURN and STUN Server. From 4.5.2 through 4.14.0, when Coturn is started with --acme-redirect <URL> and exposes a plaintext-TCP listener, an unauthenticated remote client can send a single ordinary HTTP GET request and receive a 301 response whose Location header contains up to ~870 bytes of adjacent process heap memory. The leaked region is a recycled network receive buffer that is reused without being zeroed, so on a busy server it can contain data from other clients' requests (TURN credentials, OAuth tokens, relayed payloads). Root cause is a signed\u2192unsigned conversion. This issue is fixed in version 4.15.0.", "A flaw was found in Coturn. When configured with ACME redirect and a plaintext-TCP listener, an unauthenticated remote client can send an HTTP GET request. This action can lead to the disclosure of up to approximately 870 bytes of adjacent process heap memory. On a busy server, this leaked memory may contain sensitive information from other clients, such as authentication credentials or relayed data."], "mitigation": {"lang": "en:us", "value": "No action needed - the shipped coturn build (4.16.0) already contains the upstream fix."}, "name": "CVE-2026-62959", "public_date": "2026-07-31T19:57:06Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-62959\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-62959\nhttps://github.com/coturn/coturn/commit/960835886692fa04cf63ddd970c3f330740c87f4\nhttps://github.com/coturn/coturn/pull/1965\nhttps://github.com/coturn/coturn/releases/tag/4.15.0\nhttps://github.com/coturn/coturn/security/advisories/GHSA-m23x-5qf5-988g"], "statement": "This flaw affects the community-maintained coturn TURN/STUN server as shipped in Fedora and EPEL. Red Hat does not ship coturn in any core Red Hat product. Fedora and EPEL currently ship coturn 4.16.0, which already includes the fix released in 4.15.0, so the shipped builds are not vulnerable.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.5.2,4.15.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "coturn", "source": "cna", "vendor": "coturn"}, "product": "coturn", "vendor": "coturn"}], "created": "2026-07-31T22:30:17.915862+00:00", "updated": "2026-08-13T10:30:04.813667+00:00", "vendors": ["coturn", "coturn$PRODUCT$coturn"]}