---
title: "CVE-2026-68552\n    | Ubuntu"
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2026-68552?format=md
keywords: index, follow
---

# CVE-2026-68552

Publication date 19 August 2026

Last updated 2 September 2026

---

Ubuntu priority

**Medium**

[Why this priority?](https://ubuntu.com/security/cves/about#priority )

## Cvss 3 Severity Score

**5.3 · Medium**

[Score breakdown](https://ubuntu.com/security/CVE-2026-68552?format=md#impact-score)

Toggle side navigation

## Description

Coturn is a free open source implementation of TURN and STUN Server. Prior
to 4.15.0, an unauthenticated remote client can send a STUN message over
TCP or TLS with a body-length field from 65520 through 65532, causing the
uint16\_t len variable in stun\_get\_message\_len\_str() in
src/client/ns\_turn\_msg.c to wrap when STUN\_HEADER\_LENGTH is added. The
framing layer then consumes only 4 through 16 bytes, treats the remaining
bytes as another message, desynchronizes the stream parser, and drops the
attacking client's connection. Other clients and the server process are not
affected. This issue is fixed in version 4.15.0.

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| coturn | 26.04 LTS resolute | Needs evaluation |
| 24.04 LTS noble | Needs evaluation |
| 22.04 LTS jammy | Needs evaluation |
| 20.04 LTS focal | Needs evaluation |
| 18.04 LTS bionic | Needs evaluation |
| 16.04 LTS xenial | Needs evaluation |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)

## Severity score breakdown

CVSS version:
CVSS v3.0

**Base score**

5.3 · Medium

* Base metrics

  | Parameter | Value |
  | --- | --- |
  | Attack vector | Network |
  | Attack complexity | Low |
  | Privileges required | None |
  | User interaction | None |
  | Scope | Unchanged |
  | Confidentiality impact | None |
  | Integrity impact | None |
  | Availability impact | Low |
* Scores

  | Parameter | Value |
  | --- | --- |
  | Base score | 5.3 · Medium |
  | Exploitability score | - |
  | Impact score | - |

**Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68552)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-68552)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2026-68552)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2026-68552)

### Other references

* <https://www.cve.org/CVERecord?id=CVE-2026-68552>
* <https://github.com/coturn/coturn/commit/ed32e1fb6c843f9cf9a28d91c541dfbf40874f25>
* <https://github.com/coturn/coturn/pull/1964>
* <https://github.com/coturn/coturn/releases/tag/4.15.0>
* <https://github.com/coturn/coturn/security/advisories/GHSA-m562-mf7x-q7rr>