The Coturn TURN Server Memory Leak & Format‑String Injection: Patch It, Block It, or Dig Deeper

 

Coturn TURN server memory leak & format-string injection? Patch it now with a Fedora script, block it via iptables, or learn malware analysis with two books that stop attackers dead. Subscribe for real Linux security.

Coturn TURN server vulnerability? Patch it now or learn why chasing CVEs is a losing game. Get Fedora-specific commands, automation scripts, iptables mitigations, and two books that teach you to analyze the malware that exploits security holes. Subscribe for more practical Linux security.

Let me be straight with you: a patch fixes a hole, but attackers don't just send malformed IPs. They deliver malware that exploits the flaw, persists, and phones home.

This week, Fedora shipped an update for coturn – a TURN/STUN server used heavily in VoIP and WebRTC applications. 

The update bumps version to 4.11.0 and fixes a handful of problems that have been lurking since 4.10.0: a memory leak in the Prometheus response handler, a format‑string injection vulnerability in the Redis database driver, and a few other nasty surprises.

But here's the thing. By the time you finish reading this advisory, someone else is already hammering on your network stack. So stop chasing patches. Start learning how to dissect the malware that exploits them.

In this guide, you'll get:

• A clear breakdown of what's actually broken in coturn.

• A simple command to check if your box is vulnerable (Fedora‑specific).

• A working automation script to apply the fix across your fleet.

• Immediate mitigation techniques if you can't reboot or update right now.

• Two books that teach you to build your own tools for binary analysis and malware dissection – so you stop being a patch jockey and become a real defender.

What's Actually Broken?

The coturn update (version 4.11.0) addresses multiple issues, but two deserve your immediate attention:

1. Format‑string injection in the Redis DB driver

Improper handling of format strings can allow an attacker to read from or write to arbitrary memory locations. In worst‑case scenarios, this leads to remote code execution.

2. Memory leak in Prometheus response handling (introduced in 4.10.0)

Under sustained load, the leaked memory accumulates until the server runs out of resources. The end result? A denial‑of‑service condition that takes your TURN server offline.

Additionally, the advisory fixes a misaligned memory access vulnerability (CVE‑2026‑40613) in STUN/TURN attribute parsing that can crash ARM64 deployments with a single crafted UDP packet.

Advisory Date: May 2026 (historical context only)

How to Check If You Are Vulnerable (Fedora)

Run these commands to verify your coturn version and determine if you're affected.

Step 1 – Check the installed version:

bash

dnf list installed coturn

Step 2 – Verify the exact package details:

bash

rpm -q coturn

Step 3 – If coturn is running, check its status:

bash

systemctl status coturn

You are vulnerable if:

Your installed version is below 4.11.0 (e.g., 4.10.0 or earlier).

You are running on ARM64 architecture with coturn < 4.10.0 (CVE‑2026‑40613 applies).

Step 4 – Check running processes related to TURN/STUN:

bash

ps aux | grep -E "(turnserver|coturn)"

Automation Script to Apply the Fix (Fedora)

Below is a production‑ready bash script to update coturn across your Fedora infrastructure. Run this on a non‑production system first, then roll it out.

bash

#!/bin/bash
# coturn-security-updater.sh
# Updates coturn to 4.11.0 and restarts the service.
# Uses Fedora's DNF package manager.

set -euo pipefail

# Colors for output
GREEN='\033[0;32m'
RED='\033[0;31m'
YELLOW='\033[1;33m'
NC='\033[0m'

log() { echo -e "${GREEN}[INFO]${NC} $1"; }
warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
error() { echo -e "${RED}[ERROR]${NC} $1"; exit 1; }

log "Starting coturn security update..."

# Check if running as root
if [[ $EUID -ne 0 ]]; then
   error "This script must be run as root (use sudo)."
fi

# Backup current config if it exists
if [[ -f /etc/coturn/turnserver.conf ]]; then
    backup_dir="/root/coturn_backup_$(date +%Y%m%d_%H%M%S)"
    mkdir -p "$backup_dir"
    cp -r /etc/coturn "$backup_dir/"
    log "Configuration backed up to $backup_dir"
fi

# Update package cache
log "Updating DNF cache..."
dnf makecache --refresh || warn "Cache refresh failed, continuing..."

# Perform the update
log "Upgrading coturn to 4.11.0..."
if dnf update -y coturn; then
    log "Coturn successfully upgraded."
else
    error "Failed to upgrade coturn. Check your network or repository configuration."
fi

# Verify the new version
new_version=$(rpm -q coturn)
log "Installed version: $new_version"

if ! echo "$new_version" | grep -q "4.11.0"; then
    warn "Version check shows $new_version, but 4.11.0 was expected."
fi

# Restart the service
if systemctl is-active --quiet coturn; then
    log "Restarting coturn service..."
    systemctl restart coturn
    sleep 2
    if systemctl is-active --quiet coturn; then
        log "Coturn service restarted successfully."
    else
        error "Coturn service failed to restart. Check logs with: journalctl -u coturn"
    fi
else
    log "Coturn service was not running. Enable and start it manually if needed."
fi

log "Update complete. Consider testing your TURN/STUN functionality."

To use the script:

bash

chmod +x coturn-security-updater.sh
sudo ./coturn-security-updater.sh

Important note about the script: This script resolves this specific CVE. To learn how to create your own scripts for any future CVE, you need the book. Practical Binary Analysis: Build Your Own Linux Tools for Binary Instrumentation, Analysis, and Disassembly teaches you the methods to automate security responses for the vulnerabilities you haven't even heard of yet.

Pratical Binary Analysis  (adversiting)  ->  https://amzn.to/4uxS2jJ

Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software

By Michael Sikorski and Andrew Honig

This is the industry standard for malware analysis. You'll learn to:

Set up a safe virtual environment to analyze live malware.

Extract network signatures and host‑based indicators.

Overcome anti‑debugging, anti‑disassembly, and virtualization tricks.

Unpack packed malware and analyze shellcode.

"When malware breaches your defenses, you need to act quickly to cure current infections and prevent future ones. Practical Malware Analysis will teach you the tools and techniques used by professional analysts."

Pratical Malware Analysis (adversiting)  ->  https://amzn.to/4nElbHt

I earn a comission with you make a purchase.

Alternative Mitigation If You Can't Update Now

Sometimes you can't reboot. Sometimes the update conflicts with a custom build. Use these temporary mitigations to reduce your exposure.

1. Temporarily Disable the Coturn Service

bash

sudo systemctl stop coturn
sudo systemctl disable coturn

To re‑enable later:

bash

sudo systemctl enable coturn
sudo systemctl start coturn

2. Block Coturn Ports with IPTables

If you know which ports coturn is listening on (typically 3478 for TURN/STUN, 5349 for TURN/STUN over TLS, and a UDP relay port range), block them at the firewall level:

bash

# Block UDP and TCP on port 3478
sudo iptables -A INPUT -p udp --dport 3478 -j DROP
sudo iptables -A INPUT -p tcp --dport 3478 -j DROP

# Block port 5349 for TLS traffic
sudo iptables -A INPUT -p tcp --dport 5349 -j DROP

# Block the UDP relay port range (commonly 49152-65535, adjust to your config)
sudo iptables -A INPUT -p udp --dport 49152:65535 -j DROP

To make these rules persistent (Fedora uses iptables‑services):

bash

sudo iptables-save > /etc/iptables/rules.v4

3. Use SELinux to Restrict Coturn (Fedora's built‑in security)

SELinux on Fedora already provides a basic confined domain for coturn. Verify it's enforcing:

bash

getenforce

If it's not enforcing, enable it:

bash

sudo setenforce 1

Then check that coturn is running under the correct context:

bash

ps -Z | grep turnserver

You should see system_u:system_r:turnserver_t:s0 or similar. If you see unconfined_t, tighten the policy:

bash

sudo semanage permissive -a turnserver_t   # to test
# After testing, remove permissive mode:
sudo semanage permissive -d turnserver_t

Note on AppArmor: Fedora uses SELinux by default, not AppArmor. If you're on Ubuntu or Debian, an AppArmor profile for coturn is available in the distribution repositories

Conclusion

Let me leave you with this: A patch is a bandage. Malware analysis is the cure.

You’ve got the commands to check your coturn version, the script to update it, and the iptables rules to block the damage if you can’t patch right now. That’s your tactical win for today.

But here’s the strategic truth: next week, there will be another CVE. And another. And another. Each one will get a patch, and each patch will fix a hole after the bad guys already knew about it.

The only way to stop playing catch‑up is to learn what the malware does when it gets in. Practical Malware Analysis teaches you to dissect real attacks. Practical Binary Analysis gives you the power to build your own tools for the CVEs that don’t even have a name yet.

So go ahead – run the script, lock down your ports, and sleep better tonight. Then tomorrow, start learning to think like the attacker. Because the best defense isn’t a faster patch cycle. It’s knowing exactly what you’re up against.