Quick answers
- Is CVE-2026-73213 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-73213 being exploited in the wild.
- How severe is CVE-2026-73213?
- Informational severity, published 11 August 2026.
- Which products and versions are affected?
- Coturn before 4.16.0.
- Is there a fix for CVE-2026-73213?
- A patch was published on 2026-07-31: Fixed in version 4.16.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-73213 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-73213?
- Check whether you run Coturn at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability exists in the addr_less_eq() function in src/client/ns_turn_ioaddr.c, which performs component-wise comparison for IPv6 min-max intervals within the ioa_addr_in_range() check. This comparison logic fails to correctly identify IPv6 addresses that are numerically within a configured denied-peer-ip range but are incorrectly classified as outside it, particularly when the range is not prefix-aligned. An authenticated TURN client can exploit this to relay traffic to IPv6 peers that should have been blocked. The issue is fixed in version 4.16.0.
Affected products
- Coturn Coturn before 4.16.0
Timeline
- 2026-08-11: disclosed
- 2026-07-31: patched: Fixed in version 4.16.0