{"id":"CVE-2026-62959","summary":"Coturn: Pre-authentication heap memory disclosure in ACME redirect (`try_acme_redirect`)","details":"Coturn is a free open source implementation of TURN and STUN Server. From 4.5.2 through 4.14.0, when Coturn is started with --acme-redirect \u003cURL\u003e and exposes a plaintext-TCP listener, an unauthenticated remote client can send a single ordinary HTTP GET request and receive a 301 response whose Location header contains up to ~870 bytes of adjacent process heap memory. The leaked region is a recycled network receive buffer that is reused without being zeroed, so on a busy server it can contain data from other clients' requests (TURN credentials, OAuth tokens, relayed payloads). Root cause is a signed→unsigned conversion. This issue is fixed in version 4.15.0.","aliases":["GHSA-m23x-5qf5-988g"],"modified":"2026-08-01T11:45:31.629124300Z","published":"2026-07-31T19:57:06.394Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62959.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-125","CWE-195"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62959.json"},{"type":"FIX","url":"https://github.com/coturn/coturn/commit/960835886692fa04cf63ddd970c3f330740c87f4"},{"type":"FIX","url":"https://github.com/coturn/coturn/pull/1965"},{"type":"WEB","url":"https://github.com/coturn/coturn/releases/tag/4.15.0"},{"type":"ADVISORY","url":"https://github.com/coturn/coturn/security/advisories/GHSA-m23x-5qf5-988g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62959"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/coturn/coturn","events":[{"introduced":"b31bb041191f10d2ef6488caad6a4ef03a51f1fc"},{"fixed":"ac6a9633b16a1a35ab248570484e52d138515ad5"}],"database_specific":{"extracted_events":[{"introduced":"4.5.2"},{"fixed":"4.15.0"}],"source":"AFFECTED_FIELD"}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-62959.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}