EUVD-2026-63077Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Requires valid TURN credentials (PR:L); Redis integration is common enough that AC:L holds; stack leak is Low confidentiality; process crash is High availability with no scope change.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, an authenticated TURN user can place printf-style format specifiers in the STUN USERNAME or REALM attribute, which passes is_secure_string() validation and is embedded into Redis keys at nine call sites in src/apps/relay/ns_ioalib_engine_impl.c. send_message_to_redis() in src/apps/relay/hiredis_libevent2.c then passes the attacker-controlled key as the format argument to redisAsyncCommand() while supplying only one variadic value, causing hiredis redisvFormatCommand() to read past the va_list. Exploitation can crash the coturn process and terminate active TURN sessions or disclose stack memory into Redis. This issue is fixed in version 4.13.0.
AnalysisAI
Format string injection in Coturn prior to 4.13.0 lets an authenticated TURN user crash the relay server or leak stack memory into Redis by embedding printf-style specifiers in STUN USERNAME or REALM attributes. At nine call sites in ns_ioalib_engine_impl.c, attacker-controlled values pass is_secure_string() validation and are embedded into Redis keys; send_message_to_redis() then passes the composite key as the format argument to redisAsyncCommand(), causing redisvFormatCommand() to read past the va_list. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold valid TURN long-term credentials (username and password) for the targeted Coturn instance, corresponding to PR:L in the CVSS vector; unauthenticated exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 7.1 (High) vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H is well-calibrated for this vulnerability: the attack is network-accessible and requires no special complexity beyond holding valid TURN credentials, the availability impact is High because a single crafted request can crash the coturn process and terminate all active TURN sessions, and confidentiality is Low due to stack memory potentially surfacing in Redis. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Coturn 4.13.0 or later, available at https://github.com/coturn/coturn/releases/tag/4.13.0; this is the vendor-released patch confirmed by commit 8fa38032bb4751e11e072d65a8eca3c06c950979 and security advisory GHSA-4g7c-p5wg-j4hp. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Coturn deployments and confirm versions in use, prioritizing systems running versions before 4.13.0 supporting WebRTC workloads. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Privilege escalation to root in the LiteSpeed User-End cPanel Plugin (versions 2.3 through before 2.4.5) lets attackers
UAF in Redis 8.2.1 via crafted Lua scripts by authenticated users. EPSS 12.4%. Patch available.
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10,
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user
Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.
A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. Rated cr
Code injection in OneUptime monitoring via custom JS monitor using vm module. PoC and patch available.
In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerab
An issue was found in Apache Airflow versions 1.10.10 and below. Rated critical severity (CVSS 9.8), this vulnerability
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4
goanother Another Redis Desktop Manager =<1.6.1 is vulnerable to Cross Site Scripting (XSS) via src/components/Setting.v
Same weakness CWE-134 – Use of Externally-Controlled Format String
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today