CVE-2026-62959

CVE-2026-62959 affects Coturn versions 4.5.2–4.14.0 where, when started with --acme-redirect and exposing a plaintext-TCP listener, an unauthenticated remote client can trigger a pre-auth heap-memory disclosure by sending a single HTTP GET, receiving a 301 with a Location header that leaks up to...