Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.10.0, the STUN/TURN attribute parsing functions in coturn perform unsafe pointer casts from uint8_t * to uint16_t * without alignment checks. When processing a crafted STUN message with odd-aligned attribute boundaries, this results in misaligned memory reads at ns_turn_msg.c. On ARM64 architectures (AArch64) with strict alignment enforcement, this causes a SIGBUS signal that immediately kills the turnserver process. An unauthenticated remote attacker can crash any ARM64 coturn deployment by sending a single crafted UDP packet. This vulnerability is fixed in 4.10.0.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Coturn is a free open source implementation of TURN and STUN Server. Coturn is commonly configured to
    block loopback and internal ranges using "denied-peer-ip" and/or default loopback restrictions.
    CVE-2020-26262 addressed bypasses involving "0.0.0.0", "[::1]" and "[::]", but IPv4-mapped IPv6 is not
    covered. When sending a "CreatePermission" or "ChannelBind" request with the "XOR-PEER-ADDRESS" value of
    "::ffff:127.0.0.1", a successful response is received, even though "127.0.0.0/8" is blocked via "denied-
    peer-ip". The root cause is that, prior to the updated fix implemented in version 4.9.0, three functions
    in "src/client/ns_turn_ioaddr.c" do not check "IN6_IS_ADDR_V4MAPPED". "ioa_addr_is_loopback()" checks
    "127.x.x.x" (AF_INET) and "::1" (AF_INET6), but not "::ffff:127.0.0.1." "ioa_addr_is_zero()" checks
    "0.0.0.0" and "::", but not "::ffff:0.0.0.0." "addr_less_eq()" used by "ioa_addr_in_range()" for "denied-
    peer-ip" matching: when the range is AF_INET and the peer is AF_INET6, the comparison returns 0 without
    extracting the embedded IPv4. Version 4.9.0 contains an updated fix to address the bypass of the fix for
    CVE-2020-26262. (CVE-2026-27624)

  - Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.10.0, the STUN/TURN
    attribute parsing functions in coturn perform unsafe pointer casts from uint8_t * to uint16_t * without
    alignment checks. When processing a crafted STUN message with odd-aligned attribute boundaries, this
    results in misaligned memory reads at ns_turn_msg.c. On ARM64 architectures (AArch64) with strict
    alignment enforcement, this causes a SIGBUS signal that immediately kills the turnserver process. An
    unauthenticated remote attacker can crash any ARM64 coturn deployment by sending a single crafted UDP
    packet. This vulnerability is fixed in 4.10.0. (CVE-2026-40613)

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-e673311164 advisory.

    # Coturn 4.10.0

    ## Performance
      * Add Linux-only `recvmmsg` client receive path for DTLS/UDP listener
      * Skip response buffer allocation for STUN indications
      * Remove mutex from per-thread `super_memory` allocator
      * Eliminate mutex and reduce copies on auth message dispatch
      * Replace `mutex_bps` with lock-free atomics for bandwidth tracking
      * Remove unused mutex from `ur_map` structure
      * WebRTC Auth optimization path
      * Improve worst case scenario - avoid memory allocation

    ## Memory issues
      * Fix null pointer dereferences in `post_parse()`
      * Fix stack buffer overflow in OAuth token decoding
      * Fix `uint16_t` truncation overflow in `stun_get_message_len_str()`
      * Initialize variables before use

    ## Security
      * CVE-2026-40613 Misaligned Memory Access STUN Attribute Parser

    ## General Improvements
      * Disable reason string in response messages to reduce amplification factor
      * Keep only `NEV_UDP_SOCKET_PER_THREAD` network engine
      * Replace perror with logging
      * Extend seed corpus and add more fuzzing scenarios
      * Update config and Readme files about deprecated TLSv1/1.1
      * Restore RFC 3489 (old STUN) backward compatibility broken since 4.7.0
      * Change port identifiers to use `uint16_t`
      * Fixes: `run_tests.sh` and no db
      * Improve `PostgreSQL.md` clarity
      * Add session usage reporting callback to TURN database driver
      * CLI interface is disabled by default


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-1adc5f1ef8 advisory.

    # Coturn 4.10.0

    ## Performance
      * Add Linux-only `recvmmsg` client receive path for DTLS/UDP listener
      * Skip response buffer allocation for STUN indications
      * Remove mutex from per-thread `super_memory` allocator
      * Eliminate mutex and reduce copies on auth message dispatch
      * Replace `mutex_bps` with lock-free atomics for bandwidth tracking
      * Remove unused mutex from `ur_map` structure
      * WebRTC Auth optimization path
      * Improve worst case scenario - avoid memory allocation

    ## Memory issues
      * Fix null pointer dereferences in `post_parse()`
      * Fix stack buffer overflow in OAuth token decoding
      * Fix `uint16_t` truncation overflow in `stun_get_message_len_str()`
      * Initialize variables before use

    ## Security
      * CVE-2026-40613 Misaligned Memory Access STUN Attribute Parser

    ## General Improvements
      * Disable reason string in response messages to reduce amplification factor
      * Keep only `NEV_UDP_SOCKET_PER_THREAD` network engine
      * Replace perror with logging
      * Extend seed corpus and add more fuzzing scenarios
      * Update config and Readme files about deprecated TLSv1/1.1
      * Restore RFC 3489 (old STUN) backward compatibility broken since 4.7.0
      * Change port identifiers to use `uint16_t`
      * Fixes: `run_tests.sh` and no db
      * Improve `PostgreSQL.md` clarity
      * Add session usage reporting callback to TURN database driver
      * CLI interface is disabled by default


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-1c11dc3e37 advisory.

    # Coturn 4.10.0

    ## Performance
      * Add Linux-only `recvmmsg` client receive path for DTLS/UDP listener
      * Skip response buffer allocation for STUN indications
      * Remove mutex from per-thread `super_memory` allocator
      * Eliminate mutex and reduce copies on auth message dispatch
      * Replace `mutex_bps` with lock-free atomics for bandwidth tracking
      * Remove unused mutex from `ur_map` structure
      * WebRTC Auth optimization path
      * Improve worst case scenario - avoid memory allocation

    ## Memory issues
      * Fix null pointer dereferences in `post_parse()`
      * Fix stack buffer overflow in OAuth token decoding
      * Fix `uint16_t` truncation overflow in `stun_get_message_len_str()`
      * Initialize variables before use

    ## Security
      * CVE-2026-40613 Misaligned Memory Access STUN Attribute Parser

    ## General Improvements
      * Disable reason string in response messages to reduce amplification factor
      * Keep only `NEV_UDP_SOCKET_PER_THREAD` network engine
      * Replace perror with logging
      * Extend seed corpus and add more fuzzing scenarios
      * Update config and Readme files about deprecated TLSv1/1.1
      * Restore RFC 3489 (old STUN) backward compatibility broken since 4.7.0
      * Change port identifiers to use `uint16_t`
      * Fixes: `run_tests.sh` and no db
      * Improve `PostgreSQL.md` clarity
      * Add session usage reporting callback to TURN database driver
      * CLI interface is disabled by default


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.10.0, the STUN/TURN     attribute parsing functions in coturn perform unsafe pointer casts from uint8_t * to uint16_t * without     alignment checks. When processing a crafted STUN message with odd-aligned attribute boundaries, this     results in misaligned memory reads at ns_turn_msg.c. On ARM64 architectures (AArch64) with strict     alignment enforcement, this causes a SIGBUS signal that immediately kills the turnserver process. An     unauthenticated remote attacker can crash any ARM64 coturn deployment by sending a single crafted UDP     packet. This vulnerability is fixed in 4.10.0. (CVE-2026-40613)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
441025	Alpine: multiple coturn packages: security update to 4.10.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	medium
441025	Alpine: multiple coturn packages: security update to 4.10.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	medium
310424	Fedora 42 : coturn (2026-e673311164)	Nessus	Fedora Local Security Checks	Local	high
310215	Fedora 43 : coturn (2026-1adc5f1ef8)	Nessus	Fedora Local Security Checks	Local	high
310214	Fedora 44 : coturn (2026-1c11dc3e37)	Nessus	Fedora Local Security Checks	Local	high
309094	Linux Distros Unpatched Vulnerability : CVE-2026-40613	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-40613

high

Tenable Plugins

medium

medium

high

high

high

high