CVE-2026-68552 Coturn: uint16_t truncation overflow in STUN message length causes TCP stream framing bypass
An unauthenticated remote attacker can cause a denial of service by sending crafted STUN messages that trigger an integer overflow, desynchronizing the TCP stream parser.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-68552?
CVE-2026-68552 is a medium-severity vulnerability in coturn, published on 19 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an unauthenticated remote client can send a STUN message over TCP or TLS with a body-length field from 65520 through 65532, causing the uint16_t len variable in stun_get_message_len_str() in src/client/ns_turn_msg.c to wrap when STUN_HEADER_LENGTH is added. The framing layer then consumes only 4 through 16 bytes, treats the remaining bytes as another message, desynchronizes the stream parser, and drops the attacking client's connection. Other clients and the server process are not affected. This issue is fixed in version 4.15.0.
Weakness: CWE-190
Which versions are affected by CVE-2026-68552?
How do I fix CVE-2026-68552?
Upgrade to a fixed version.
Is CVE-2026-68552 being exploited?
There is no known exploitation of CVE-2026-68552 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-68552, GHSA-m562-mf7x-q7rr, UBUNTU-CVE-2026-68552.