Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U H H H 9.8 .0045 37.6 —
AFFECTED Product Versions Fixed coturn < 4.10.0 – —
TIMELINE May 4 Reserved by GitHub_M Jun 18 EXPLOIT PUBLISHED — CVE-2026-43994 (coturn). Public exploit reference added. Jun 18 Published (CNA: GitHub_M)
Coturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.10.0 contain a stack buffer overflow in decode_oauth_token_gcm(). A uint16_t nonce_len field read from an attacker-supplied OAuth access token (0-65535) is passed directly to memcpy() as the copy length into a 256-byte stack buffer (oauth_encrypted_block.nonce[256]) without bounds checking. The overflow occurs before AES-GCM authentication is verified, the attacker does not need to know the OAuth key or produce a valid AES-GCM token. Up to 735 bytes of attacker-controlled data are written past the buffer, may corrupt adjacent stack data, including control-flow data depending on compiler, ABI, and mitigations. Requires --oauth mode (non-default). This may provide a plausible RCE primitive depending on exploit mitigations; because coturn is widely deployed for WebRTC TURN/STUN and --oauth is commonly recommended, impact can be broad. This issue has been fixed in version 4.10.0.
| Date | Event | Detail |
|---|---|---|
| May 4, 2026 | Reserved | Reserved by GitHub_M |
| June 18, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-43994 (coturn). Public exploit reference added. |
| June 18, 2026 | Published | Published (CNA: GitHub_M) |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| coturn | coturn | — | < 4.10.0 | — |
Authoritative record: CVE-2026-43994 at cve.org
Vendors: coturn
Weaknesses: CWE-120
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-43994 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.