The vulnerability is an uninitialized stack memory disclosure in Coturn 4.10.0. An unauthenticated attacker can send a TURN Allocate request without credentials. The flawed stun_init_error_response_common_str() function fails to clear the avalue buffer before calculating its length, allowing the attacker to read stack bytes returned in the ERROR-CODE reason phrase. This leak exposes pointer fragments that can weaken ASLR and facilitate precise version fingerprinting, increasing the value of future attacks.

The affected product is Coturn version 4.10.0, provided by the coturn project. Users running this exact version are vulnerable. The issue was addressed in the 4.11.0 release.

With a CVSS score of 6.9 the vulnerability is considered moderate severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog, which suggests a lower current exploitation likelihood, though the absence of an EPSS score limits confidence. Attacks require only network access to a TURN server and do not need authentication, meaning any remote host can exploit it. The vulnerability enables information disclosure that can be used in subsequent attacks, so the risk is non‑negligible.