Hi,

The following vulnerabilities were published for coturn.

CVE-2026-53449[0]:
| Coturn is a free open source implementation of TURN and STUN Server.
| Prior to 4.13.0, the psd print sessions dump CLI command in coturn
| takes a filename argument and directly passes it to fopen with no
| path validation. An authenticated admin with CLI access can
| overwrite arbitrary files writable by the coturn process because the
| command string is used as-is after stripping the psd prefix and
| leading spaces, allowing truncation and overwrite with session dump
| data. This issue is fixed in version 4.13.0.


CVE-2026-53450[1]:
| Coturn is a free open source implementation of TURN and STUN Server.
| Prior to 4.13.0, coturn rejects loopback peers by default unless
| allow-loopback-peers is enabled, but the default loopback guard can
| be bypassed by using the IPv4-mapped IPv6 peer address
| ::ffff:127.0.0.1 in a TURN XOR-PEER-ADDRESS attribute.
| ioa_addr_is_loopback checks for the literal IPv6 loopback shape
| before IPv4-mapped IPv6 handling, so good_peer_addr does not apply
| the default loopback rejection and an authenticated TURN client can
| expose services bound only to localhost on the coturn host through
| TURN relay traffic. This issue is fixed in version 4.13.0.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-53449
https://www.cve.org/CVERecord?id=CVE-2026-53449
[1] https://security-tracker.debian.org/tracker/CVE-2026-53450
https://www.cve.org/CVERecord?id=CVE-2026-53450

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
coturn, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1142275@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Christoph Martin <chrism@debian.org> (supplier of updated coturn package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 20 Jul 2026 14:19:22 +0200
Source: coturn
Architecture: source
Version: 4.14.0-1
Distribution: unstable
Urgency: high
Maintainer: Debian VoIP Team <pkg-voip-maintainers@lists.alioth.debian.org>
Changed-By: Christoph Martin <chrism@debian.org>
Closes: 1142275
Changes:
 coturn (4.14.0-1) unstable; urgency=high
 .
   * [67f67a7] update gbp.conf
   * [288b71c] New upstream version 4.14.0
   * fixes CVE-2026-53449 CVE-2026-53450 (closes: #1142275)
Checksums-Sha1:
 f44552851be68ad645079161a5e6290dd90d5aff 2256 coturn_4.14.0-1.dsc
 dea2dbdd3c7f6c2c55da5b135f7c6e2beb9f5be0 497372 coturn_4.14.0.orig.tar.xz
 3eb90b205670ec32a317a633ea1a7341d4c90ffd 14640 coturn_4.14.0-1.debian.tar.xz
 ec8ab0a8847615d223b8004bb9a102be5c52e316 7495 coturn_4.14.0-1_amd64.buildinfo
Checksums-Sha256:
 2c3d13151263e2fdcece508856081f88d0583595201158f11f4a77accec01c24 2256 coturn_4.14.0-1.dsc
 1093aa0ef442fffba968bc1c4759610e8887d725c64256fbe374e117da21ca4f 497372 coturn_4.14.0.orig.tar.xz
 f421c04cc7cea7087c46247a003d188fdaa4f2e405f4fcf3f9f663d1463d68be 14640 coturn_4.14.0-1.debian.tar.xz
 912f54d364973e0c0ea81e4b0f717a0693163221e1aaccb6a18fc6e71f00716d 7495 coturn_4.14.0-1_amd64.buildinfo
Files:
 abcabc47251f6a4cfdee110dc750ebdc 2256 net optional coturn_4.14.0-1.dsc
 130fbbe4f09d41b1d83ddd260feced58 497372 net optional coturn_4.14.0.orig.tar.xz
 b9c6300fa2a0b1c39ff81a7ca1773ba9 14640 net optional coturn_4.14.0-1.debian.tar.xz
 72ec9f0e38c112d2e0c81b23eb8e3f9b 7495 net optional coturn_4.14.0-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEbdFebnsTnCYy4y02kcMUbl2GabQFAmpeEwwACgkQkcMUbl2G
abSksg//eaxLJlnF1L9HVcOrX8vpKh9nvH1UbsrAWxTyCeVw3N1RvsRcJj07951v
35puNTLmupRFa2V+IppW3pJkaRpwahZsXqjT5u53d7P7Skjf+vuWxMxAr76HZpiU
SjyZxZS2b4gzo9G6R8558nfRVjEx26AIxlZDGVF4ScYu6gAbgB3dnDt+rTDMvw4U
9bSu/GKExntiCLQNqwpmCT/7lC9xqMPy9/dYHrjtmZhyeZfaKnJIFw0QzNj8NDJ+
lIAVG8VwDXQTJQHwio09kK/HLe36TEgcT10kHX+ZbLKXC5F2muS1JtL1XPQQWcm5
J/i6pCPpWuFE5V4E54Ooy3L2NPqMCosNaFZwhmIjdZHskIWNxWgejaw7m2LfHQhv
vrbH2z3Z3Ob/LFBt7VrOo15bofp5aqE7xbAE9qhJKq/UatA6l6Ms+yhnUQmihyro
cbNLa2Xyab0p4y3ooHkGD0nfEs2JPeFYIvFnZbYNsj7M0JUViC0NUHq7ExuoE3L9
qLUQ1vCyamjK0NkKWeLL6OqVvb1jpT5GlYpTNkL5VnY5tcLfbjXqGe6tzMPZj31R
6iffjerWJr7+tuyKqleBtCLx6YvRxdFxEwJ/XkP6v+GMAyeziJxAm0vetlyGC/mV
LGFpTsVogU+k7/Wjs+2df2ePyoQ9m3UAES1K2q7295w364A1wyc=
=BO+t
-----END PGP SIGNATURE-----