CVE-2026-43994 is a stack buffer overflow (CVSS 8.1, high) in coturn before version 4.10.0, in the code that decodes OAuth access tokens. It happens before the token is authenticated, so no valid key is needed. It needs the non default oauth mode. Upgrade to coturn 4.10.0.
What's affected
The advisory lists coturn versions up to and including 4.9.0 as affected and 4.10.0 as patched.
Only servers started with the oauth option are exposed, and that mode is not on by default. The advisory warns that oauth is often recommended for WebRTC deployments, so many servers may use it.
How to check if you're exposed
- Read the version.
turnserver --version
- Check how the server starts. Look in the systemd unit, container command line and turnserver.conf for the oauth option.
- If oauth is not used, this issue does not apply to your configuration, though you should still upgrade.
- If your TURN service is public, note that anyone on the internet can send it a token.
What to do now
- Upgrade coturn to 4.10.0 or later.
- If you cannot upgrade, stop using oauth mode until you can.
- Run coturn as a low privilege user, in a container, with a read only file system where possible.
- Make sure memory protections such as stack protection and ASLR are enabled in your build.
- Watch for crashes or restarts of the TURN service in your logs.
Why it matters
The weakness is CWE-120, a classic buffer copy without checking size. A two byte length field from the token, up to 65535, is used to copy data into a 256 byte buffer. The advisory says up to 735 bytes of attacker data can land past the buffer.
The fault occurs before the cryptographic check, so protecting the token with a key does not help. The advisory says it may give a path to code execution depending on mitigations. Attack complexity is rated high. The KEV flag is false.
Quick check
Is the default configuration affected?
No. The advisory says it requires oauth mode, which is not the default.
Sources
Last reviewed: 19 October 2026.
