Vulnerability Spotlight: Memory corruption, DoS vulnerabilities in CoTURN
Summary: Cisco Talos's Aleksandar Nikolic discovered denial-of-service and memory corruption vulnerabilities in CoTURN 4.5.1.1's web server, which parses POST requests. A specially crafted HTTP POST can crash the server, while a crafted HTTPS POST can trigger a heap overflow leading to information leaks and other misbehavior; CoTURN has released an update, and Quarkslab independently reported the same issues.
Bottom line: CoTURN is a general-purpose TURN server and gateway, so a crash or heap overflow in its admin web server sits on a path that may be reachable by anyone who can send it a request.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2020-6062
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026