CVE-2026-40613

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.10.0, the STUN/TURN attribute parsing functions in coturn perform unsafe pointer casts from uint8_t * to uint16_t * without alignment checks. When processing a crafted STUN message with odd-aligned attribute boundaries, this results in misaligned memory reads at ns_turn_msg.c. On ARM64 architectures (AArch64) with strict alignment enforcement, this causes a SIGBUS signal that immediately kills the turnserver process. An unauthenticated remote attacker can crash any ARM64 coturn deployment by sending a single crafted UDP packet. This vulnerability is fixed in 4.10.0.

• CWE-704

• https://github.com/coturn/coturn/security/advisories/GHSA-j662-9wcj-mf36Exploit, Vendor Advisory
• https://github.com/coturn/coturn/security/advisories/GHSA-j662-9wcj-mf36Exploit, Vendor Advisory

Published

Apr 21, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40608Next AI Draw.io is a next.js web application that integrates…5.5
• CVE-2026-40609Rejected reason: This CVE is a duplicate of another CVE.
• CVE-2026-4061The Geo Mashup plugin for WordPress is vulnerable to Time-Ba…7.5
• CVE-2026-40610BentoML is a Python library for building online serving syst…5.5
• CVE-2026-40611Let's Encrypt client and ACME library written in Go (Lego). …8.8
• CVE-2026-40612jq is a command-line JSON processor. In 1.8.1 and earlier, j…5.5
• CVE-2026-40614PJSIP is a free and open source multimedia communication lib…8.8
• CVE-2026-40618When an SSL profile is configured on a virtual server on BIG…8.7
• CVE-2026-40619A high security vulnerability affecting Security Center main…7.8
• CVE-2026-4062The Geo Mashup plugin for WordPress is vulnerable to Time-Ba…7.5
• CVE-2026-40620A vulnerability in SenseLive X3050’s embedded management ser…9.8
• CVE-2026-40621ELECOM wireless LAN access point devices do not require auth…9.8