What is the CVSS score of CVE-2026-40613?

CVE-2026-40613 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Coturn are affected by CVE-2026-40613?

CVE-2026-40613 affects Coturn TURN/STUN servers deployed on ARM64 architecture, enabling unauthenticated remote attackers to crash the service with a single malformed network packet.. A patch is available.

How to fix or mitigate CVE-2026-40613?

Within 24 hours: Identify all ARM64-based Coturn deployments in your infrastructure and document their version numbers and network exposure. Within 7 days: Implement network-layer filtering on UDP ports used by Coturn (typically 3478-3479) to restrict traffic to trusted sources only, and deploy monitoring for abnormal process crashes. Within 30 days: Migrate affected ARM64 deployments to x86-64 architecture if operationally feasible, or maintain continuous vendor advisory monitoring for Coturn 4.10.0+ patch availability.

Coturn CVE-2026-40613

EUVD-2026-24228 HIGH

Incorrect Type Conversion or Cast (CWE-704)

2026-04-21 GitHub_M

Denial Of Service Coturn

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Apr 24, 2026 - 13:41 nvd

Patch available

Re-analysis Queued

Apr 21, 2026 - 21:22 vuln.today

cvss_changed

Patch available

Apr 21, 2026 - 20:02 EUVD

Analysis Generated

Apr 21, 2026 - 19:46 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 19:00 euvd

EUVD-2026-24228

Analysis Generated

Apr 21, 2026 - 19:00 vuln.today

CVE Published

Apr 21, 2026 - 18:00 nvd

HIGH 7.5

DescriptionGitHub Advisory

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.10.0, the STUN/TURN attribute parsing functions in coturn perform unsafe pointer casts from uint8_t * to uint16_t * without alignment checks. When processing a crafted STUN message with odd-aligned attribute boundaries, this results in misaligned memory reads at ns_turn_msg.c. On ARM64 architectures (AArch64) with strict alignment enforcement, this causes a SIGBUS signal that immediately kills the turnserver process. An unauthenticated remote attacker can crash any ARM64 coturn deployment by sending a single crafted UDP packet. This vulnerability is fixed in 4.10.0.

AnalysisAI

Remote denial of service in Coturn TURN/STUN server allows unauthenticated attackers to crash ARM64 deployments with a single malformed UDP packet. The vulnerability triggers a fatal SIGBUS signal via misaligned memory access during STUN attribute parsing, requiring no authentication or special configuration. All ARM64 installations of Coturn prior to 4.10.0 are vulnerable to instant process termination. EPSS exploitation probability is not yet available as this is a newly disclosed CVE, but the attack complexity is low (AC:L) and requires no privileges (PR:N), making exploitation trivial once awareness spreads in attacker communities.

Technical ContextAI

Coturn is an open-source TURN (Traversal Using Relays around NAT) and STUN (Session Traversal Utilities for NAT) server widely used in WebRTC deployments, VoIP systems, and real-time communication platforms. The vulnerability exists in the STUN message attribute parsing code at ns_turn_msg.c, specifically in functions that cast uint8_t pointers to uint16_t pointers without verifying memory alignment. STUN protocol messages contain variable-length attributes with type-length-value structures. On ARM64 (AArch64) processors with strict alignment enforcement, attempting to read a 16-bit value from an odd memory address violates hardware alignment requirements. When a crafted STUN message positions attribute boundaries at odd byte offsets, the unsafe pointer cast triggers misaligned memory access, causing the kernel to deliver a SIGBUS signal that immediately terminates the turnserver process. This falls under CWE-704 (Incorrect Type Conversion or Cast), specifically relating to pointer alignment assumptions that are valid on x86_64 but fatal on strict-alignment architectures. The vulnerability is architectural in nature, affecting only ARM64 deployments while x86_64 systems tolerate the misaligned access with performance degradation rather than crashes.

RemediationAI

Upgrade Coturn to version 4.10.0 or later, which includes fixes for unsafe pointer casting in STUN attribute parsing functions. The patch implements proper alignment checks before performing type conversions in ns_turn_msg.c. For ARM64 deployments unable to immediately upgrade, implement the following compensating controls in priority order: deploy a STUN/TURN protocol proxy or firewall with strict message validation on x86_64 hardware in front of ARM64 Coturn instances (eliminates misaligned packets before reaching vulnerable code but adds latency and infrastructure complexity); restrict network access to Coturn ports (UDP/TCP 3478, 5349 for TLS) using IP allowlisting to trusted peer servers only (reduces attack surface but breaks open relay scenarios required for some WebRTC use cases); migrate ARM64 Coturn instances to x86_64 architecture temporarily (avoids the vulnerability entirely but requires infrastructure changes and may increase cloud costs). Process monitoring with automatic restart on SIGBUS (systemd with Restart=always) provides service continuity but does not prevent exploitation and may mask ongoing attacks. Download the official patch and review the GitHub security advisory at https://github.com/coturn/coturn/security/advisories/GHSA-j662-9wcj-mf36 for additional technical guidance.