Coturn, versions 4.5.2 through 4.14.0, suffered a pre‑authentication heap memory disclosure when the --acme-redirect option was enabled and a plaintext‑TCP listener was exposed. A single HTTP GET request to the advertised URL triggers a 301 response that leaks up to roughly 870 bytes of the server’s adjacent process heap. The leaked data come from a recycled network receive buffer that is not reset, so the bytes may include TURN credentials, OAuth tokens, or other clients’ payloads. Because the attack does not require authentication and relies only on a benign GET, the vulnerability enables remote attackers to read sensitive information residing in memory.

The affected product is coturn, the open‑source TURN/STUN server. All releases between 4.5.2 and 4.14.0 are vulnerable. The fix is available in version 4.15.0, which addresses the signed‑to‑unsigned conversion that caused the buffer reuse.

The CVSS score of 8.2 indicates a high‑severity information‑disclosure flaw, yet the EPSS score of less than 1% suggests a low probability of active exploitation at this time. The issue is not listed in the CISA KEV catalog. Exploitation requires only that a remote host be able to open a plain TCP connection to the coturn server’s listener and issue an ordinary HTTP GET request. The attacker gains no direct adversary benefit other than the ability to read possibly sensitive data leaked from the heap.