Is CVE-2026-73212 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73212 being exploited in the wild.

How severe is CVE-2026-73212?

Informational severity, with a CVSS score of 0, published 11 August 2026.

Is there a fix for CVE-2026-73212?

A patch was published on 2026-06-14: Fix committed to repository; version 4.13.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-73212 attacked?

It is attacked over the network.

Am I affected by CVE-2026-73212?

Check whether you run Coturn at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73212: Coturn TURN/STUN relay ACL bypass via IPv6 address encoding

CVE-2026-73212 · Severity: info · CVSS 0 · Published 2026-08-11

Coturn is a TURN/STUN relay server used to facilitate real-time communication through firewalls. An authenticated attacker can bypass the server's denied-peer-ip access control list by re-encoding target IPv4 addresses in alternative IPv6 formats (IPv4-compatible, 6to4, or NAT64), potentially enabling relay to otherwise-blocked destinations. This affects RFC 6062 TCP CONNECT clients on systems with matching translation routes.

Technologies: Coturn. Vendors: Coturn.

Quick answers

Is CVE-2026-73212 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73212 being exploited in the wild.
How severe is CVE-2026-73212?: Informational severity, with a CVSS score of 0, published 11 August 2026.
Which products and versions are affected?: Coturn prior to 4.13.1.
Is there a fix for CVE-2026-73212?: A patch was published on 2026-06-14: Fix committed to repository; version 4.13.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73212 attacked?: It is attacked over the network.
Am I affected by CVE-2026-73212?: Check whether you run Coturn at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an access control bypass in the good_peer_addr() function, which validates relay destinations against configured denied-peer-ip ranges. The function calls ioa_addr_in_range() without first canonicalizing IPv4-in-IPv6 address encodings (IPv4-compatible ::a.b.c.d, 6to4 2002::/16, and NAT64 well-known prefix 64:ff9b::/96). Because the comparison operates on the full 16-byte IPv6 form, alternative encodings of the same IPv4 address are not recognized as matching IPv4 deny rules. An authenticated RFC 6062 TCP CONNECT relay client can exploit this by sending connection requests using alternative address encodings to reach denied peers. The vulnerability requires the Coturn host to have a useful translation route for the target encoding. Version 4.13.1 fixes this by introducing ioa_addr_get_embedded_ipv4() to extract and canonicalize embedded IPv4 addresses before range checking.

Affected products

Coturn Coturn prior to 4.13.1

Timeline

2026-08-11: disclosed
2026-06-14: patched: Fix committed to repository; version 4.13.1 released
2026-08-11: advisory: CVE-2026-73212 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.