{"id":"CVE-2026-122126","kind":"vulnerability","aliases":["CVE-2026-122126"],"related":[],"title":"reSIProcate reTurn client: oversized TURN frames overflow heap buffer","description":"reSIProcate reTurn client through 1.14.0 contains a heap buffer overflow in TurnTcpSocket::handleReadHeader() that allows malicious TURN servers to overwrite memory via oversized frame lengths. Attackers can send STUN or ChannelData frames declaring up to 65535 bytes, writing roughly 57 KB past the fixed 8192-byte mReadBuffer and crashing the client.","summary":"The reTurn TURN client in reSIProcate through 1.14.0 has a heap buffer overflow in TurnTcpSocket::handleReadHeader() where frame lengths are not checked against the 8192-byte read buffer. A malicious TURN server can send frames declaring up to 65535 bytes, overwriting roughly 57 KB of adjacent memory and crashing the client.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"resiprocate","fixed":[],"affected":"<= 1.14.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["package","resiprocate","turn-client","voip","webrtc"],"not_affected_if":["no-return-client-use","trusted-turn-servers-only"],"how_to_check":"- Find whether your application links the reTurn client (search the build for reTurn, TurnTcpSocket or TurnTlsSocket). The PR says the async socket classes already had the length check; the synchronous client did not.\n- Check the resiprocate version: 1.14.0 or earlier is affected. Check reTurn/client/TurnTcpSocket.cxx for the bounds check added in commit 5bb559f.\n- Check whether the client connects to TURN servers you do not control, or over plain TCP on a network where others can inject traffic.","fix":"No fixed release yet (1.14.0 is the latest and is affected). The fix is merged on master in commit 5bb559fd96298073cab369fdfa610f981fb01e95 (PR #496): build from master at or after that commit, or cherry-pick it. Oversized frames now fail with FrameError and the socket is closed.","status":"open","published_at":"2026-11-04T21:18:08+00:00","first_seen_at":"2026-11-04T21:49:19+00:00","triaged_at":"2026-11-04T21:50:44+00:00","updated_at":"2026-11-04T21:53:34+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-04T21:50:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"reSIProcate reTurn client: oversized TURN frames overflow heap buffer","impact":"high","summary":"The reTurn TURN client in reSIProcate through 1.14.0 has a heap buffer overflow in TurnTcpSocket::handleReadHeader() where frame lengths are not checked against the 8192-byte read buffer. A malicious TURN server can send frames declaring up to 65535 bytes, overwriting roughly 57 KB of adjacent memory and crashing the client.","audience":"developers","category":"package","nicknames":[],"who_cares":["resiprocate","turn-client","voip","webrtc"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Malicious TURN server crashes the client and may overwrite heap memory.","analyst_note":"Confirm the fixed version from the linked patch on github.com and the VulnCheck advisory; sources do not name one.","how_to_check":"- Check whether the reTurn client library from reSIProcate is linked into your application, for example by searching the build for `reTurn` or `TurnTcpSocket`.\n- Confirm the installed reSIProcate version is `1.14.0` or earlier.\n- Check whether the client connects to TURN servers you do not control.","plain_action":"","needs_analyst":true,"not_affected_if":["trusted-turn-servers-only","no-reTurn-client-use"],"who_is_affected":"The flaw is in the reTurn TURN client code, so it matters to applications that use that client to talk to TURN servers. The sources describe a malicious TURN server as the trigger, so clients that only connect to trusted TURN servers are at lower risk. The sources do not name a fixed version, though a patch link is listed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000744,"input_tokens":4214,"output_tokens":646,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version from the linked patch on github.com and the VulnCheck advisory; sources do not name one.","search":"'-122126':12A,15A '-2026':11A,14A '1.14.0':31B,79C '57':66B,114C '65535':62B,110C '8192':48B,119C 'adjac':69B 'allow':89C 'attack':100C 'buffer':9A,35B,51B,83C 'byte':49B,63B,111C,120C 'channeldata':105C 'check':45B 'client':3A,21B,27B,74B,77C,125C 'contain':80C 'crash':72B,123C 'cve':10A,13A 'declar':59B,107C 'fix':118C 'frame':6A,41B,58B,98C,106C 'handlereadhead':39B,87C 'heap':8A,34B,82C 'kb':67B,115C 'length':42B,99C 'malici':53B,90C 'memori':70B,95C 'mreadbuff':121C 'overflow':7A,36B,84C 'overs':4A,97C 'overwrit':64B,94C 'packag':17B 'past':116C 'read':50B 'resiproc':1A,18B,29B,75C 'resiprocate':16A 'return':2A,25B,76C 'rough':65B,113C 'send':57B,102C 'server':55B,92C 'stun':103C 'turn':5A,20B,26B,54B,91C 'turn-client':19B 'turntcpsocket':38B,86C 'via':96C 'voip':22B 'webrtc':23B 'write':112C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the synchronous reTurn TURN client (TurnTcpSocket, and TurnTlsSocket which inherits it) from reSIProcate 1.14.0 or earlier, typically VoIP or WebRTC clients. A malicious TURN server, or anyone who can write into a plain TCP stream to the client, can send an oversized frame and overwrite up to about 57 KB of heap, which crashes the client. Applications that do not use the reTurn client, or that only talk to trusted TURN servers, can mostly skip it.","tier":"B","verified":{"fix":{"at":"2026-11-04T21:53:34Z","by":"analyst","doc":"https://github.com/resiprocate/resiprocate/commit/5bb559fd96298073cab369fdfa610f981fb01e95","run_id":1718},"how_to_check":{"at":"2026-11-04T21:53:34Z","by":"analyst","doc":"https://github.com/resiprocate/resiprocate/commit/5bb559fd96298073cab369fdfa610f981fb01e95","run_id":1718}},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["resiprocate"],"ptokens":["resiprocate"],"labels":["high","package","resiprocate","turnclient","voip","webrtc"],"campaign_type":null,"first_public_at":"2026-11-04T21:18:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122126","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122126","severity":null,"published_at":"2026-11-04T21:18:08+00:00","modified_at":"2026-11-04T21:18:08+00:00","first_seen_at":"2026-11-04T21:49:19+00:00","fetched_at":"2026-11-04T21:49:19+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-122126:1718","url":"https://github.com/resiprocate/resiprocate/pull/496","severity":null,"published_at":"2026-11-04T21:53:34+00:00","modified_at":"2026-11-04T21:53:34+00:00","first_seen_at":"2026-11-04T21:53:34+00:00","fetched_at":"2026-11-04T21:53:34+00:00","note":"Fix is PR #496 merged to master 2026-11-02 (commit 5bb559f); latest release 1.14.0 is vulnerable, no release containing the fix found. VulnCheck lists <=1.14.0. Maintainer thread read; PR also says anyone able to write into the plain TCP stream to the client can trigger it, not only a malicious server.","cites":["https://github.com/resiprocate/resiprocate/pull/496"]}],"documents":[{"id":70640,"url":"https://github.com/resiprocate/resiprocate/commit/5bb559fd96298073cab369fdfa610f981fb01e95","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":70641,"url":"https://www.vulncheck.com/advisories/resiprocate-return-client-through-1.14.0-heap-buffer-overflow-via-turntcpsocket","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"},{"id":70882,"url":"https://github.com/resiprocate/resiprocate/pull/496","title":"reTurn: check frame length against the sync TCP client's read buffer (PR #496)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}