CVE-2026-40613 Coturn: Misaligned Memory Access in coturn STUN Attribute Parser (Remote DoS on ARM64)

High 7.5 Published 21 Apr 2026 Updated 21 Apr 2026

Remote unauthenticated attackers can crash ARM64 coturn servers via crafted UDP packets due to misaligned memory access in STUN parsing.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-40613?

CVE-2026-40613 is a high-severity denial of service vulnerability in coturn, published on 21 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.10.0, the STUN/TURN attribute parsing functions in coturn perform unsafe pointer casts from uint8_t * to uint16_t * without alignment checks. When processing a crafted STUN message with odd-aligned attribute boundaries, this results in misaligned memory reads at ns_turn_msg.c. On ARM64 architectures (AArch64) with strict alignment enforcement, this causes a SIGBUS signal that immediately kills the turnserver process. An unauthenticated remote attacker can crash any ARM64 coturn deployment by sending a single crafted UDP packet. This vulnerability is fixed in 4.10.0.

Weakness: CWE-704

Which versions are affected by CVE-2026-40613?

It affects 1 product.

Products include Coturn Project Coturn.

How do I fix CVE-2026-40613?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-40613 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40613 exists.

Sources

Also known as DEBIAN-CVE-2026-40613, GHSA-j662-9wcj-mf36, MGASA-2026-0217, UBUNTU-CVE-2026-40613.