{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"coturn","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":[],"id":"tcs_01M5NPMWK5M4C14C6DPBASSV0F","modified_at":"2026-10-10T16:00:05.882827949Z","published_at":"2026-10-07T15:17:02.760Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-104074","https://security-tracker.debian.org/tracker/CVE-2026-104074"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-104074#Debian:13/coturn","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-104074"}],"summary":"Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote unauthenticated attackers to leak stack memory contents by sending a TURN Allocate request without credential"}