Quick answers
- Is CVE-2026-73214 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-73214 being exploited in the wild.
- How severe is CVE-2026-73214?
- Informational severity, with a CVSS score of 7.5, published 11 August 2026.
- Which products and versions are affected?
- Coturn before 4.16.0.
- Is there a fix for CVE-2026-73214?
- A patch was published on 2026-07-26: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-73214 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-73214?
- Check whether you run Coturn at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability exists in dtls_server_input_handler() and create_new_connected_udp_socket() in src/apps/relay/dtls_listener.c. The DTLS listener allocates per-peer SSL state and OpenSSL's dtls1_reassemble_fragment() begins buffering fragments before cookie validation occurs. An attacker can send a 35-byte fragmented ClientHello declaring a 650,000-byte handshake, causing OpenSSL to allocate large buffers for each fragment without the attacker needing to provide credentials, complete the handshake, validate a cookie, or even use consistent source addresses. An attacker sending datagrams from many spoofed addresses can exhaust server memory. The fix (version 4.16.0) caps the number of concurrent half-open DTLS handshakes globally across relay threads and requires reservation before allocating per-peer state.
Affected products
- Coturn Coturn before 4.16.0
Timeline
- 2026-07-26: patched: Fix committed to repository
- 2026-08-11: disclosed: CVE-2026-73214 published