CVE-2026-104074
- Source
- https://cve.org/CVERecord?id=CVE-2026-104074
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104074.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-104074
- Downstream
- Published
- 2026-10-07T14:29:45Z
- Modified
- 2026-10-28T11:03:36Z
- Severity
-
- 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Coturn 4.10.0 Uninitialized Stack Memory Disclosure via ERROR-CODE
- Details
-
Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote unauthenticated attackers to leak stack memory contents by sending a TURN Allocate request without credentials. Attackers can exploit the stun_init_error_response_common_str() function in src/client/ns_turn_msg.c, which fails to zero-initialize the avalue buffer before computing its length with strlen() and copying leaked stack bytes into the ERROR-CODE reason phrase, exposing pointer fragments that weaken ASLR and enable precise version fingerprinting.
- Database specific
{ "cna_assigner": "VulnCheck", "cwe_ids": [ "CWE-908" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104074.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104074.json
- https://github.com/coturn/coturn/releases/tag/4.11.0
- https://nvd.nist.gov/vuln/detail/CVE-2026-104074
- https://github.com/coturn/coturn/pull/1878
- https://github.com/coturn/coturn/commit/741b2983cc52f967dd08c438fd72a5f08f13ca27
- https://github.com/coturn/coturn
Affected packages
Git / github.com/coturn/coturn
Affected ranges
- Type
- GIT
- Repo
- https://github.com/coturn/coturn
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "4.10.0" }, { "fixed": "4.11.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" }, { "original_tag": "4.11.0", "range": [ { "fixed": "97fd597fcb64861392b399ac824b044a2f0f5786" } ], "source": "REFERENCES_TAG" }, { "range": [ { "fixed": "741b2983cc52f967dd08c438fd72a5f08f13ca27" } ], "source": "REFERENCES_COMMIT" } ] }
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104074.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"262663662170969885956453933113526182290",
"269516451829296353736618621886733456487",
"37412971278165556297606953430003903131",
"151046911104757235431441841418993296762",
"246758831515118639984487534346367343378",
"12955399452236455481246949452517767135",
"144594325112936258757854526473948019519",
"199288184515583418821046978966700652374",
"136145239648604574703335012611027331100"
],
"threshold": 0.9
},
"id": "CVE-2026-104074-1a05f86a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/coturn/coturn/commit/741b2983cc52f967dd08c438fd72a5f08f13ca27",
"target": {
"file": "fuzzing/FuzzStunClient.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"209466104550094393623796029233136945806",
"118522817555719207568345817535853420126",
"248465128480754514368277405059117892207",
"277188127625295842373981638413595416117",
"23778707098094017080820188080225058209",
"259689851110043917914800010148552633283",
"291601413280594884689858186109590473783"
],
"threshold": 0.9
},
"id": "CVE-2026-104074-5f7043d5",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/coturn/coturn/commit/741b2983cc52f967dd08c438fd72a5f08f13ca27",
"target": {
"file": "tests/test_stun_msg.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "29369884236567229368405819660192655063",
"length": 200
},
"id": "CVE-2026-104074-6dee9cc5",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/coturn/coturn/commit/741b2983cc52f967dd08c438fd72a5f08f13ca27",
"target": {
"file": "src/client/ns_turn_msg.c",
"function": "turn_random_number"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "45728902995588567422929384214618952123",
"length": 215
},
"id": "CVE-2026-104074-6e36ff99",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/coturn/coturn/commit/741b2983cc52f967dd08c438fd72a5f08f13ca27",
"target": {
"file": "src/client/ns_turn_msg.c",
"function": "generate_random_nonce"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "121699488225151849515404333310758666383",
"length": 217
},
"id": "CVE-2026-104074-838d60d1",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/coturn/coturn/commit/741b2983cc52f967dd08c438fd72a5f08f13ca27",
"target": {
"file": "src/client/ns_turn_msg.c",
"function": "turn_random_tid_size"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "334939929989548546274935489126038315797",
"length": 780
},
"id": "CVE-2026-104074-917bfa43",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/coturn/coturn/commit/741b2983cc52f967dd08c438fd72a5f08f13ca27",
"target": {
"file": "src/client/ns_turn_msg.c",
"function": "stun_init_error_response_common_str"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "83533780705550758399149945004117129800",
"length": 525
},
"id": "CVE-2026-104074-c8ec0277",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/coturn/coturn/commit/741b2983cc52f967dd08c438fd72a5f08f13ca27",
"target": {
"file": "tests/test_stun_msg.c",
"function": "main"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"330338912929398238476581561571000203336",
"95400226565210336547328658170421595447",
"316447727582704819980044389908660438659",
"4345860201099206306995611623135997462",
"171173659187758597307323967678300743466",
"52875576848215347678086417933362161798",
"45606532579344324158123666640003519998",
"175637431324047303355884811905058155309",
"83687102121018224159155823509157462269",
"25307697626355769786535299337298895683",
"62997751888879540601801965861496004129",
"274766148166433938075237303615151289722",
"138325624625471533023428280676276311901",
"125627601908497847704506543080061514575",
"209328414210176753083013043544625503289",
"245489589706398210931550437362240519137",
"150154980941905370870363430702987281870",
"112047346456884697885351391262067404016",
"145526725837111277034726054829730338565",
"108943412127203470004471799712668999556",
"9819981683901783473756977803602106805",
"290450616262156025537248202348848353855",
"283819002805929788989598190085349249206",
"22475149324677459117258232502046520446",
"311790789830034819907103123811261955363",
"198805439586514224733538875299198319447",
"78802569720588981700120596750263938893",
"315330956216378234778642900800707178660",
"113661376677369635590901284608842231116",
"44528963049923939858127317805443405997",
"197578156531471658002698047195307504972"
],
"threshold": 0.9
},
"id": "CVE-2026-104074-d59f3c2c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/coturn/coturn/commit/741b2983cc52f967dd08c438fd72a5f08f13ca27",
"target": {
"file": "src/client/ns_turn_msg.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "269940238059124276141084093595065011363",
"length": 154
},
"id": "CVE-2026-104074-e8337b3f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/coturn/coturn/commit/741b2983cc52f967dd08c438fd72a5f08f13ca27",
"target": {
"file": "fuzzing/FuzzStunClient.c",
"function": "LLVMFuzzerTestOneInput"
}
}
]
vanir_signatures_modified
"2026-10-28T11:03:36Z"