---
id: "CVE-2026-122126"
kind: "vulnerability"
aliases: ["CVE-2026-122126"]
title: "reSIProcate reTurn client: oversized TURN frames overflow heap buffer"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "resiprocate", "fixed": [], "affected": "<= 1.14.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["package", "resiprocate", "turn-client", "voip", "webrtc"]
not_affected_if: ["no-return-client-use", "trusted-turn-servers-only"]
published_at: "2026-11-04T21:18:08+00:00"
first_seen_at: "2026-11-04T21:49:19+00:00"
updated_at: "2026-11-04T21:53:34+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122126", "first_seen_at": "2026-11-04T21:49:19+00:00"}, {"source": "analyst", "url": "https://github.com/resiprocate/resiprocate/pull/496", "first_seen_at": "2026-11-04T21:53:34+00:00", "cites": ["https://github.com/resiprocate/resiprocate/pull/496"]}]
exploit_sources: []
---

# reSIProcate reTurn client: oversized TURN frames overflow heap buffer

The reTurn TURN client in reSIProcate through 1.14.0 has a heap buffer overflow in TurnTcpSocket::handleReadHeader() where frame lengths are not checked against the 8192-byte read buffer. A malicious TURN server can send frames declaring up to 65535 bytes, overwriting roughly 57 KB of adjacent memory and crashing the client.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:resiprocate affected <= 1.14.0 fixed ?

## How to check

- Find whether your application links the reTurn client (search the build for reTurn, TurnTcpSocket or TurnTlsSocket). The PR says the async socket classes already had the length check; the synchronous client did not.
- Check the resiprocate version: 1.14.0 or earlier is affected. Check reTurn/client/TurnTcpSocket.cxx for the bounds check added in commit 5bb559f.
- Check whether the client connects to TURN servers you do not control, or over plain TCP on a network where others can inject traffic.

## Fix

No fixed release yet (1.14.0 is the latest and is affected). The fix is merged on master in commit 5bb559fd96298073cab369fdfa610f981fb01e95 (PR #496): build from master at or after that commit, or cherry-pick it. Oversized frames now fail with FrameError and the socket is closed.

## Timeline

- 2026-11-04T21:49:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-122126
- 2026-11-04T21:53:34+00:00 analyst https://github.com/resiprocate/resiprocate/pull/496 — Fix is PR #496 merged to master 2026-11-02 (commit 5bb559f); latest release 1.14.0 is vulnerable, no release containing the fix found. VulnCheck lists <=1.14.0. Maintainer thread read; PR also says anyone able to write into the plain TCP stream to the client can trigger it, not only a malicious server.

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/resiprocate-return-client-through-1.14.0-heap-buffer-overflow-via-turntcpsocket
- [fix] Patch: github.com https://github.com/resiprocate/resiprocate/commit/5bb559fd96298073cab369fdfa610f981fb01e95
- [fix] reTurn: check frame length against the sync TCP client's read buffer (PR #496) https://github.com/resiprocate/resiprocate/pull/496

## From the sources

reSIProcate reTurn client through 1.14.0 contains a heap buffer overflow in TurnTcpSocket::handleReadHeader() that allows malicious TURN servers to overwrite memory via oversized frame lengths. Attackers can send STUN or ChannelData frames declaring up to 65535 bytes, writing roughly 57 KB past the fixed 8192-byte mReadBuffer and crashing the client.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_