CVE-2026-68553

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68553", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-30T19:56:44.102Z", "datePublished": "2026-08-19T20:37:42.319Z", "dateUpdated": "2026-08-20T19:48:45.809Z"}, "containers": {"cna": {"title": "Coturn: Format String Injection via TURN USERNAME/REALM into hiredis Redis Command", "problemTypes": [{"descriptions": [{"cweId": "CWE-134", "lang": "en", "description": "CWE-134: Use of Externally-Controlled Format String", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/coturn/coturn/security/advisories/GHSA-4g7c-p5wg-j4hp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/coturn/coturn/security/advisories/GHSA-4g7c-p5wg-j4hp"}, {"name": "https://github.com/coturn/coturn/commit/8fa38032bb4751e11e072d65a8eca3c06c950979", "tags": ["x_refsource_MISC"], "url": "https://github.com/coturn/coturn/commit/8fa38032bb4751e11e072d65a8eca3c06c950979"}, {"name": "https://github.com/coturn/coturn/releases/tag/4.13.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/coturn/coturn/releases/tag/4.13.0"}], "affected": [{"vendor": "coturn", "product": "coturn", "versions": [{"version": "< 4.13.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-19T20:37:42.319Z"}, "descriptions": [{"lang": "en", "value": "Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, an authenticated TURN user can place printf-style format specifiers in the STUN USERNAME or REALM attribute, which passes is_secure_string() validation and is embedded into Redis keys at nine call sites in src/apps/relay/ns_ioalib_engine_impl.c. send_message_to_redis() in src/apps/relay/hiredis_libevent2.c then passes the attacker-controlled key as the format argument to redisAsyncCommand() while supplying only one variadic value, causing hiredis redisvFormatCommand() to read past the va_list. Exploitation can crash the coturn process and terminate active TURN sessions or disclose stack memory into Redis. This issue is fixed in version 4.13.0."}], "source": {"advisory": "GHSA-4g7c-p5wg-j4hp", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/coturn/coturn/security/advisories/GHSA-4g7c-p5wg-j4hp", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-20T19:48:40.817549Z", "id": "CVE-2026-68553", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-20T19:48:45.809Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-68553", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-20T19:48:40.817549Z"}}}], "references": [{"url": "https://github.com/coturn/coturn/security/advisories/GHSA-4g7c-p5wg-j4hp", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-20T19:48:26.856Z"}}], "cna": {"title": "Coturn: Format String Injection via TURN USERNAME/REALM into hiredis Redis Command", "source": {"advisory": "GHSA-4g7c-p5wg-j4hp", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "coturn", "product": "coturn", "versions": [{"status": "affected", "version": "< 4.13.0"}]}], "references": [{"url": "https://github.com/coturn/coturn/security/advisories/GHSA-4g7c-p5wg-j4hp", "name": "https://github.com/coturn/coturn/security/advisories/GHSA-4g7c-p5wg-j4hp", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/coturn/coturn/commit/8fa38032bb4751e11e072d65a8eca3c06c950979", "name": "https://github.com/coturn/coturn/commit/8fa38032bb4751e11e072d65a8eca3c06c950979", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/coturn/coturn/releases/tag/4.13.0", "name": "https://github.com/coturn/coturn/releases/tag/4.13.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, an authenticated TURN user can place printf-style format specifiers in the STUN USERNAME or REALM attribute, which passes is_secure_string() validation and is embedded into Redis keys at nine call sites in src/apps/relay/ns_ioalib_engine_impl.c. send_message_to_redis() in src/apps/relay/hiredis_libevent2.c then passes the attacker-controlled key as the format argument to redisAsyncCommand() while supplying only one variadic value, causing hiredis redisvFormatCommand() to read past the va_list. Exploitation can crash the coturn process and terminate active TURN sessions or disclose stack memory into Redis. This issue is fixed in version 4.13.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-134", "description": "CWE-134: Use of Externally-Controlled Format String"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-19T20:37:42.319Z"}}}, "cveMetadata": {"cveId": "CVE-2026-68553", "state": "PUBLISHED", "dateUpdated": "2026-08-20T19:48:45.809Z", "dateReserved": "2026-07-30T19:56:44.102Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-19T20:37:42.319Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "coturn", "vendor": "coturn", "versions": [{"status": "affected", "version": "< 4.13.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, an authenticated TURN user can place printf-style format specifiers in the STUN USERNAME or REALM attribute, which passes is_secure_string() validation and is embedded into Redis keys at nine call sites in src/apps/relay/ns_ioalib_engine_impl.c. send_message_to_redis() in src/apps/relay/hiredis_libevent2.c then passes the attacker-controlled key as the format argument to redisAsyncCommand() while supplying only one variadic value, causing hiredis redisvFormatCommand() to read past the va_list. Exploitation can crash the coturn process and terminate active TURN sessions or disclose stack memory into Redis. This issue is fixed in version 4.13.0."}, {"lang": "es", "value": "Coturn es una implementaci\u00f3n gratuita de c\u00f3digo abierto de servidor TURN y STUN. Antes de 4.13.0, un usuario TURN autenticado puede colocar especificadores de formato estilo printf en el atributo STUN USERNAME o REALM, lo que pasa la validaci\u00f3n de is_secure_string() y se incrusta en las claves de Redis en nueve sitios de llamada en src/apps/relay/ns_ioalib_engine_impl.c. send_message_to_redis() en src/apps/relay/hiredis_libevent2.c luego pasa la clave controlada por el atacante como argumento de formato a redisAsyncCommand() mientras suministra solo un valor vari\u00e1dico, lo que hace que hiredis redisvFormatCommand() lea m\u00e1s all\u00e1 de la va_list. La explotaci\u00f3n puede bloquear el proceso de coturn y terminar las sesiones TURN activas o divulgar la memoria de la pila en Redis. Este problema se corrige en la versi\u00f3n 4.13.0."}], "id": "CVE-2026-68553", "lastModified": "2026-10-26T10:10:00.140", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-68553", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-20T19:48:40.817549Z", "version": "2.0.3"}}]}, "published": "2026-08-19T21:17:28.163", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/coturn/coturn/commit/8fa38032bb4751e11e072d65a8eca3c06c950979"}, {"source": "security-advisories@github.com", "url": "https://github.com/coturn/coturn/releases/tag/4.13.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/coturn/coturn/security/advisories/GHSA-4g7c-p5wg-j4hp"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/coturn/coturn/security/advisories/GHSA-4g7c-p5wg-j4hp"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-134"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "coturn: Coturn: Format string vulnerability leads to denial of service and information disclosure", "id": "2520746", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520746"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H", "status": "draft"}, "cwe": "CWE-134", "details": ["Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, an authenticated TURN user can place printf-style format specifiers in the STUN USERNAME or REALM attribute, which passes is_secure_string() validation and is embedded into Redis keys at nine call sites in src/apps/relay/ns_ioalib_engine_impl.c. send_message_to_redis() in src/apps/relay/hiredis_libevent2.c then passes the attacker-controlled key as the format argument to redisAsyncCommand() while supplying only one variadic value, causing hiredis redisvFormatCommand() to read past the va_list. Exploitation can crash the coturn process and terminate active TURN sessions or disclose stack memory into Redis. This issue is fixed in version 4.13.0.", "A flaw was found in Coturn. An authenticated TURN user can exploit a format string vulnerability by injecting printf-style format specifiers into the STUN USERNAME or REALM attribute. This can lead to a crash of the coturn process, resulting in a Denial of Service (DoS) and termination of active TURN sessions. Additionally, this vulnerability may disclose sensitive stack memory into Redis."], "mitigation": {"lang": "en:us", "value": "Upgrade to coturn version 4.13.0 or later."}, "name": "CVE-2026-68553", "public_date": "2026-08-19T20:37:42Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68553\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68553\nhttps://github.com/coturn/coturn/commit/8fa38032bb4751e11e072d65a8eca3c06c950979\nhttps://github.com/coturn/coturn/releases/tag/4.13.0\nhttps://github.com/coturn/coturn/security/advisories/GHSA-4g7c-p5wg-j4hp"], "statement": "Coturn is not shipped in any Red Hat product. The Fedora and EPEL community builds ship coturn version 4.17.2, which already includes the fix for this issue (fixed in 4.13.0) and are therefore not affected.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.13.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "coturn", "source": "cna", "vendor": "coturn"}, "product": "coturn", "vendor": "coturn"}], "created": "2026-08-20T01:00:04.913820+00:00", "updated": "2026-08-20T08:15:17.075214+00:00", "vendors": ["coturn", "coturn$PRODUCT$coturn"]}