CVE-2026-43994: Coturn OAuth Token Stack Buffer Overflow in decode_oauth_token_gcm()

Overview

CVE-2026-43994 is a classic buffer overflow (CWE-120) in Coturn, the open source TURN and STUN server widely used for WebRTC media relay. The flaw is in the function decode_oauth_token_gcm(): a 16-bit nonce length taken from an attacker-supplied OAuth access token is used as the copy length into a fixed 256-byte stack buffer without any bounds check. Because the copy happens before AES-GCM authentication is verified, an attacker does not need the OAuth key or a valid token to trigger it.

Impact

According to the vendor advisory, up to 735 bytes of attacker-controlled data can be written past the buffer, potentially corrupting adjacent stack data, including control-flow data depending on compiler, ABI and exploit mitigations. The advisory describes this as a plausible remote code execution primitive. At minimum, a crash of the server (denial of service for TURN/STUN relaying) is a realistic outcome.

NVD CVSS 3.1: 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
GitHub (CNA) CVSS 3.1: 8.1
The difference between scores likely reflects how each scorer weighed exploit complexity; both rate the issue as serious.

Affected products and versions

Coturn versions prior to 4.10.0
Only deployments running with --oauth mode enabled are exposed; this mode is not the default, but the advisory notes it is commonly recommended.

Exploitation status

The issue is not listed in the CISA Known Exploited Vulnerabilities catalog, and no confirmed exploitation appears in the sources consulted. NVD tags the advisory reference with "Exploit", which suggests technical details sufficient for reproduction are public. No EPSS score was available in the record.

Remediation and mitigation

Upgrade to Coturn 4.10.0, which fixes the issue.
If an immediate upgrade is not possible, consider disabling --oauth mode temporarily and using another authentication mechanism, accepting the operational trade-offs.
Restrict network exposure of TURN/STUN ports where the deployment allows it, and ensure the service runs with least privilege and with compiler hardening (stack protectors, ASLR, non-executable stack) enabled.
Check distribution or container image packages, which may ship older Coturn builds.

Detection guidance

Inventory Coturn instances and identify those running a version earlier than 4.10.0 with --oauth enabled.
Monitor for unexpected Coturn crashes, restarts or stack-protector abort messages, which could indicate attempts to trigger the overflow.
Where TURN traffic is inspected, look for requests carrying unusually large or malformed OAuth access tokens.

Limitations of the available information

The record contains no EPSS or SSVC data. Practical exploitability for code execution depends on platform-specific mitigations and is not quantified in the sources. Information about backported fixes in third-party distributions was not available.

Frequently asked questions

Which Coturn versions are affected by CVE-2026-43994?

Coturn versions prior to 4.10.0 are affected, but only when the server runs with the non-default --oauth mode enabled.

Does an attacker need valid OAuth credentials?

No. The overflow occurs before AES-GCM authentication is checked, so the attacker does not need the OAuth key or a valid token.

Is CVE-2026-43994 being exploited in the wild?

It is not listed in CISA KEV and no confirmed exploitation appears in the sources consulted, although NVD tags the advisory as containing exploit information.

How do I fix it?

Upgrade to Coturn 4.10.0. As a temporary measure, consider disabling --oauth mode and limiting network exposure of the service.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.