---
id: CVE-2026-122126
title: >-
  reSIProcate reTurn client through 1.14.0 Heap Buffer Overflow via
  TurnTcpSocket
summary: >-
  reSIProcate reTurn client through 1.14.0 contains a heap buffer overflow in
  TurnTcpSocket::handleReadHeader(), which TurnTlsSocket inherits, that allows
  malicious TURN servers or on-path attackers to overwrite memory via oversized
  frame …
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-122
vendor: resiprocate
product: resiprocate
affected:
  - resiprocate <= 1.14.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T19:34:00.602010Z'
published: '2026-11-04'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T19:34:17.666Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-122126'
references:
  - url: 'https://github.com/resiprocate/resiprocate/pull/496'
    label: 'Pull Request #496'
  - url: >-
      https://github.com/resiprocate/resiprocate/commit/5bb559fd96298073cab369fdfa610f981fb01e95
    label: Patch Commit
  - url: 'https://github.com/resiprocate/resiprocate'
  - url: >-
      https://github.com/resiprocate/resiprocate/blob/resiprocate-1.14.0/reTurn/client/TurnTcpSocket.cxx#L124-L147
  - url: >-
      https://www.vulncheck.com/advisories/resiprocate-return-client-through-1.14.0-heap-buffer-overflow-via-turntcpsocket
    label: >-
      VulnCheck Advisory: reSIProcate reTurn client through 1.14.0 Heap Buffer
      Overflow via TurnTcpSocket
tags:
  - cve.org
epss: 0.00369
epssPercentile: 0.30934
ingestedAt: '2026-11-05T22:38:31.551Z'
---

## Overview

reSIProcate reTurn client through 1.14.0 contains a heap buffer overflow in TurnTcpSocket::handleReadHeader(), which TurnTlsSocket inherits, that allows malicious TURN servers or on-path attackers to overwrite memory via oversized frame lengths. Attackers can send STUN or ChannelData frames declaring up to 65535 bytes, writing roughly 57 KB past the fixed 8192-byte mReadBuffer and crashing the client. Only the synchronous TCP and TLS client is affected; the asynchronous client (TurnAsyncSocket) and the reTurn server are not.

## Affected

- `resiprocate <= 1.14.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.