A uint16_t truncation overflow in Coturn’s STUN message length handling allows an unauthenticated remote client to send a specially crafted message over TCP or TLS. The overflow causes the framing layer to consume an incorrect number of bytes, causing the stream parser to desynchronize and immediately drop the attacking client’s connection. The server’s state and other clients remain unaffected, but the targeted client experiences a denial of service.

The vulnerability affects coturn:coturn prior to version 4.15.0. Versions 4.15.0 and later contain a fix that prevents the uint16_t wrap and restores proper message framing.

The CVSS score of 5.3 indicates moderate severity, the EPSS score is not available, and the issue is not listed in the CISA KEV catalog. The attack vector is remote, unauthenticated, and requires the ability to send STUN messages to the server. Exploitation results in the client’s connection being dropped, with no impact on the server or on other clients.