Back Linuxsecurity Fedora 42 Coturn Important Security Bypass Fix CVE-2026
The Coturn TURN Server is a VoIP media traffic NAT traversal server and gateway. It can be used as a general-purpose network traffic TURN server/gateway, too. This implementation also includes some extra features. Supported RFCs: TURN specs: - RFC 5766 - base TURN specs - RFC 6062 - TCP relaying TURN extension - RFC 6156 - IPv6 extension for TURN - Experimental DTLS support as client protocol. STUN specs: - RFC 3489 - "classic" STUN - RFC 5389 - base "new" STUN specs - RFC 5769 - test vectors for STUN protocol testing - RFC 5780 - NAT behavior discovery support The implementation fully supports the following client-to-TURN-server protocols: - UDP (per RFC 5766) - TCP (per RFC 5766 and RFC 6062) - TLS (per RFC 5766 and RFC 6062); TLS1.0/TLS1.1/TLS1.2 - DTLS (experimental non-standard feature) Supported relay protocols: - UDP (per RFC 5766) - TCP (per RFC 6062) Supported user databases (for user repository, with passwords or keys, if authentication is required): - SQLite - MySQL - PostgreSQL - Redis Redis can also be used for status and statistics storage and notification. Supported TURN authentication mechanisms: - long-term - TURN REST API (a modification of the long-term mechanism, for time-limited secret-based authentication, for WebRTC applications) The load balancing can be implemented with the following tools (either one or a combination of them): - network load-balancer server - DNS-based load balancing - built-in ALTERNATE-SERVER mechanism. Update Information : Coturn 4.9.0 Multiple security fixes Fix to Web Admin password check Cleanup of deprecated OpenSSL APIs Fix for CVE-2026-27624: Bypass localhost and IP range block using IPv4-mapped IPv6
The Coturn TURN Server is a VoIP media traffic NAT traversal server and gateway.
It can be used as a general-purpose network traffic TURN server/gateway, too.
This implementation also includes some extra features. Supported RFCs:
- RFC 5766 - base TURN specs
- RFC 6062 - TCP relaying TURN extension
- RFC 6156 - IPv6 extension for TURN
- Experimental DTLS support as client protocol.
- RFC 3489 - "classic" STUN
- RFC 5389 - base "new" STUN specs
- RFC 5769 - test vectors for STUN protocol testing
- RFC 5780 - NAT behavior discovery support
The implementation fully supports the following client-to-TURN-server protocols:
- TCP (per RFC 5766 and RFC 6062)
- TLS (per RFC 5766 and RFC 6062); TLS1.0/TLS1.1/TLS1.2
- DTLS (experimental non-standard feature)
Supported relay protocols:
Supported user databases (for user repository, with passwords or keys, if
authentication is required):
Redis can also be used for status and statistics storage and notification.
Supported TURN authentication mechanisms:
- TURN REST API (a modification of the long-term mechanism, for time-limited
secret-based authentication, for WebRTC applications)
The load balancing can be implemented with the following tools (either one or a
combination of them):
- network load-balancer server
- DNS-based load balancing
- built-in ALTERNATE-SERVER mechanism.
Coturn 4.9.0 Multiple security fixes Fix to Web Admin password check Cleanup of deprecated OpenSSL APIs Fix for CVE-2026-27624: Bypass localhost and IP range block using IPv4-mapped IPv6
* Wed Feb 25 2026 Robert Scheck - 4.9.0-1 - Upgrade to 4.9.0 (#2442144) - Add patch to build successfully using OpenSSL 1.1.1 on RHEL 8 * Fri Jan 16 2026 Fedora Release Engineering - 4.8.0-3 - Rebuilt for * Fri Jan 16 2026 Fedora Release Engineering - 4.8.0-2 - Rebuilt for
* Wed Feb 25 2026 Robert Scheck - 4.9.0-1 - Upgrade to 4.9.0 (#2442144) - Add patch to build successfully using OpenSSL 1.1.1 on RHEL 8 * Fri Jan 16 2026 Fedora Release Engineering - 4.8.0-3 - Rebuilt for * Fri Jan 16 2026 Fedora Release Engineering - 4.8.0-2 - Rebuilt for
[ 1 ] Bug #2442550 - CVE-2026-27624 coturn: IPv4-mapped IPv6 bypasses denied-peer-ip ACL
[ 1 ] Bug #2442550 - CVE-2026-27624 coturn: IPv4-mapped IPv6 bypasses denied-peer-ip ACL
This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-2a1aa1f57f' at the command line. For more information, refer to the dnf documentation available at
This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-2a1aa1f57f' at the command line. For more information, refer to the dnf documentation available at
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
