Skip to content
OpenAdvisories
High USN-4690-1 1 CVE

coturn vulnerability

Published Jan 11, 2021 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

It was discovered that coTURN allowed peers to connect and relay packets to
loopback addresses in the range of 127.x.x.x. A malicious user could use this
vulnerability to insert packages into the loopback interface.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 16.04 LTS 16.04:LTS coturn 4.5.0.3-1ubuntu0.4
Ubuntu · 18.04 LTS 18.04:LTS coturn 4.5.0.7-1ubuntu2.18.04.3
Ubuntu · 20.04 LTS 20.04:LTS coturn 4.5.1.1-1.1ubuntu0.20.04.2

Vulnerabilities 1

  • High 7.2
    CVE-2020-26262

    Loopback bypass in Coturn

    Coturn is free open source implementation of TURN and STUN Server. Coturn before version 4.5.2 by default does not allow peers to connect and relay packets to loopback addresses in the range of `127.x.x.x`. However, it was observed that when sending a `CONNEC…

    coturn coturn coturn coturn Debian Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2020-26262