{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"coturn","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:12","exploited":false,"fixed_versions":[],"id":"tcs_01M5NPMWFAYNR3J26CCRKQNR8R","modified_at":"2026-10-10T16:00:05.882827949Z","published_at":"2026-10-07T15:17:02.760Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-104074","https://security-tracker.debian.org/tracker/CVE-2026-104074"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-104074","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-104074"}],"summary":"Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote unauthenticated attackers to leak stack memory contents by sending a TURN Allocate request without credential"}