Junglewise Threat Intelligence

CVE-2026-73215: Coturn EVEN-PORT relay port exhaustion

CVE-2026-73215 · Severity: info · CVSS 0 · Published 2026-08-11

Technologies: Coturn. Vendors: Coturn.

Executive brief

Coturn is an open-source TURN/STUN server that enables voice, video, and data relay in peer-to-peer applications. A logic error in port allocation causes the server to permanently mark sibling ports as in-use even when not needed, allowing an authenticated client to exhaust the relay port pool and prevent new connections with a service error. This creates a denial-of-service condition where users cannot establish new relay sessions.

Technical details

The vulnerability is a resource exhaustion flaw in the turnports_allocate_even() function in src/apps/relay/turn_ports.c. When an authenticated client requests an EVEN-PORT allocation with the reservation (R) bit clear (indicating no RTCP socket should be reserved), the server incorrectly marks the odd sibling port as TPS_TAKEN_ODD. Since no RTCP socket is bound to this sibling for R=0 requests, it is never released, permanently removing one port from the available pool. An attacker can repeatedly issue EVEN-PORT(R=0) Allocate requests to exhaust the relay port range, causing subsequent allocations to fail with STUN error 508. Authentication is required; the fix in version 4.17.0 returns the even port immediately when R=0, leaving the sibling available.

Affected products

  • Coturn Coturn prior to 4.17.0

Timeline

  • 2026-08-11: disclosed
  • 2026-08-05: patched: Fixed in version 4.17.0

References

Related threats