{"action":"Upgrade coturn to 4.12.0-1 or later.","affected":[{"fixed":"4.12.0-1","introduced":"0"}],"component":"coturn","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:14","exploited":false,"fixed_versions":["4.12.0-1"],"id":"tcs_01M5NPMWPR6VNW5EV9XNZ9T2W9","modified_at":"2026-10-10T16:00:05.882827949Z","published_at":"2026-10-07T15:17:02.760Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-104074","https://security-tracker.debian.org/tracker/CVE-2026-104074"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-104074#Debian:14/coturn","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-104074"}],"summary":"Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote unauthenticated attackers to leak stack memory contents by sending a TURN Allocate request without credential"}