Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.10.0, the STUN/TURN attribute parsing functions in coturn perform unsafe pointer casts from uint8_t * to uint16_t * without alignment checks. When processing a crafted STUN message with odd-aligned attribute boundaries, this results in misaligned memory reads at ns_turn_msg.c. On ARM64 architectures (AArch64) with strict alignment enforcement, this causes a SIGBUS signal that immediately kills the turnserver process. An unauthenticated remote attacker can crash any ARM64 coturn deployment by sending a single crafted UDP packet. This vulnerability is fixed in 4.10.0.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-e673311164 advisory.

    # Coturn 4.10.0

    ## Performance
      * Add Linux-only `recvmmsg` client receive path for DTLS/UDP listener
      * Skip response buffer allocation for STUN indications
      * Remove mutex from per-thread `super_memory` allocator
      * Eliminate mutex and reduce copies on auth message dispatch
      * Replace `mutex_bps` with lock-free atomics for bandwidth tracking
      * Remove unused mutex from `ur_map` structure
      * WebRTC Auth optimization path
      * Improve worst case scenario - avoid memory allocation

    ## Memory issues
      * Fix null pointer dereferences in `post_parse()`
      * Fix stack buffer overflow in OAuth token decoding
      * Fix `uint16_t` truncation overflow in `stun_get_message_len_str()`
      * Initialize variables before use

    ## Security
      * CVE-2026-40613 Misaligned Memory Access STUN Attribute Parser

    ## General Improvements
      * Disable reason string in response messages to reduce amplification factor
      * Keep only `NEV_UDP_SOCKET_PER_THREAD` network engine
      * Replace perror with logging
      * Extend seed corpus and add more fuzzing scenarios
      * Update config and Readme files about deprecated TLSv1/1.1
      * Restore RFC 3489 (old STUN) backward compatibility broken since 4.7.0
      * Change port identifiers to use `uint16_t`
      * Fixes: `run_tests.sh` and no db
      * Improve `PostgreSQL.md` clarity
      * Add session usage reporting callback to TURN database driver
      * CLI interface is disabled by default


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-1adc5f1ef8 advisory.

    # Coturn 4.10.0

    ## Performance
      * Add Linux-only `recvmmsg` client receive path for DTLS/UDP listener
      * Skip response buffer allocation for STUN indications
      * Remove mutex from per-thread `super_memory` allocator
      * Eliminate mutex and reduce copies on auth message dispatch
      * Replace `mutex_bps` with lock-free atomics for bandwidth tracking
      * Remove unused mutex from `ur_map` structure
      * WebRTC Auth optimization path
      * Improve worst case scenario - avoid memory allocation

    ## Memory issues
      * Fix null pointer dereferences in `post_parse()`
      * Fix stack buffer overflow in OAuth token decoding
      * Fix `uint16_t` truncation overflow in `stun_get_message_len_str()`
      * Initialize variables before use

    ## Security
      * CVE-2026-40613 Misaligned Memory Access STUN Attribute Parser

    ## General Improvements
      * Disable reason string in response messages to reduce amplification factor
      * Keep only `NEV_UDP_SOCKET_PER_THREAD` network engine
      * Replace perror with logging
      * Extend seed corpus and add more fuzzing scenarios
      * Update config and Readme files about deprecated TLSv1/1.1
      * Restore RFC 3489 (old STUN) backward compatibility broken since 4.7.0
      * Change port identifiers to use `uint16_t`
      * Fixes: `run_tests.sh` and no db
      * Improve `PostgreSQL.md` clarity
      * Add session usage reporting callback to TURN database driver
      * CLI interface is disabled by default


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-1c11dc3e37 advisory.

    # Coturn 4.10.0

    ## Performance
      * Add Linux-only `recvmmsg` client receive path for DTLS/UDP listener
      * Skip response buffer allocation for STUN indications
      * Remove mutex from per-thread `super_memory` allocator
      * Eliminate mutex and reduce copies on auth message dispatch
      * Replace `mutex_bps` with lock-free atomics for bandwidth tracking
      * Remove unused mutex from `ur_map` structure
      * WebRTC Auth optimization path
      * Improve worst case scenario - avoid memory allocation

    ## Memory issues
      * Fix null pointer dereferences in `post_parse()`
      * Fix stack buffer overflow in OAuth token decoding
      * Fix `uint16_t` truncation overflow in `stun_get_message_len_str()`
      * Initialize variables before use

    ## Security
      * CVE-2026-40613 Misaligned Memory Access STUN Attribute Parser

    ## General Improvements
      * Disable reason string in response messages to reduce amplification factor
      * Keep only `NEV_UDP_SOCKET_PER_THREAD` network engine
      * Replace perror with logging
      * Extend seed corpus and add more fuzzing scenarios
      * Update config and Readme files about deprecated TLSv1/1.1
      * Restore RFC 3489 (old STUN) backward compatibility broken since 4.7.0
      * Change port identifiers to use `uint16_t`
      * Fixes: `run_tests.sh` and no db
      * Improve `PostgreSQL.md` clarity
      * Add session usage reporting callback to TURN database driver
      * CLI interface is disabled by default


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.10.0, the STUN/TURN     attribute parsing functions in coturn perform unsafe pointer casts from uint8_t * to uint16_t * without     alignment checks. When processing a crafted STUN message with odd-aligned attribute boundaries, this     results in misaligned memory reads at ns_turn_msg.c. On ARM64 architectures (AArch64) with strict     alignment enforcement, this causes a SIGBUS signal that immediately kills the turnserver process. An     unauthenticated remote attacker can crash any ARM64 coturn deployment by sending a single crafted UDP     packet. This vulnerability is fixed in 4.10.0. (CVE-2026-40613)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
310424	Fedora 42 : coturn (2026-e673311164)	Nessus	Fedora Local Security Checks	high
310215	Fedora 43 : coturn (2026-1adc5f1ef8)	Nessus	Fedora Local Security Checks	high
310214	Fedora 44 : coturn (2026-1c11dc3e37)	Nessus	Fedora Local Security Checks	high
309094	Linux Distros Unpatched Vulnerability : CVE-2026-40613	Nessus	Misc.	high

Detections

Analytics

CVE-2026-40613

high

Tenable Plugins

high

high

high

high