Coturn CVE-2026-62959

Coturn is a widely used open-source C implementation of TURN (RFC 5766) and STUN (RFC 5389), commonly deployed as a WebRTC relay. The vulnerability resides in src/apps/relay/acme.c within try_acme_redirect(), the handler invoked when the --acme-redirect flag is active. CWE-125 (Out-of-bounds Read) applies: the function calls is_acme_req() which returns negative int values (-1, -2, -3) on all rejection paths. Before the fix, this return value was stored directly into a size_t variable (plen). On 64-bit systems, assigning -1 to size_t wraps to 0xFFFFFFFFFFFFFFFF, a value that bypasses the lower-bound length guard. The code then used plen to NUL-terminate req[plen] at an arbitrary heap offset and subsequently passed req + GET_ACME_PREFIX_LEN as a %s argument to snprintf, reading from an un-terminated string through adjacent heap into the 301 Location response header. The leaked region is a recycled network receive buffer that is not zeroed between uses, making its contents attacker-observable. The fix (commit 960835886692fa04cf63ddd970c3f330740c87f4, PR #1965) introduces an intermediate signed int prc, checks for negative values before any unsigned cast, and copies the path to a bounded local stack buffer (path[131+1]) rather than mutating the shared receive buffer.