Is CVE-2026-73215 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73215 being exploited in the wild.

How severe is CVE-2026-73215?

Informational severity, with a CVSS score of 0, published 11 August 2026.

Is there a fix for CVE-2026-73215?

A patch was published on 2026-08-05: Fixed in version 4.17.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-73215 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-73215?

Check whether you run Coturn at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73215: Coturn EVEN-PORT relay port exhaustion

CVE-2026-73215 · Severity: info · CVSS 0 · Published 2026-08-11

Coturn is an open-source TURN/STUN server that enables voice, video, and data relay in peer-to-peer applications. A logic error in port allocation causes the server to permanently mark sibling ports as in-use even when not needed, allowing an authenticated client to exhaust the relay port pool and prevent new connections with a service error. This creates a denial-of-service condition where users cannot establish new relay sessions.

Technologies: Coturn. Vendors: Coturn.

Quick answers

Is CVE-2026-73215 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73215 being exploited in the wild.
How severe is CVE-2026-73215?: Informational severity, with a CVSS score of 0, published 11 August 2026.
Which products and versions are affected?: Coturn prior to 4.17.0.
Is there a fix for CVE-2026-73215?: A patch was published on 2026-08-05: Fixed in version 4.17.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73215 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-73215?: Check whether you run Coturn at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a resource exhaustion flaw in the turnports_allocate_even() function in src/apps/relay/turn_ports.c. When an authenticated client requests an EVEN-PORT allocation with the reservation (R) bit clear (indicating no RTCP socket should be reserved), the server incorrectly marks the odd sibling port as TPS_TAKEN_ODD. Since no RTCP socket is bound to this sibling for R=0 requests, it is never released, permanently removing one port from the available pool. An attacker can repeatedly issue EVEN-PORT(R=0) Allocate requests to exhaust the relay port range, causing subsequent allocations to fail with STUN error 508. Authentication is required; the fix in version 4.17.0 returns the even port immediately when R=0, leaving the sibling available.

Affected products

Coturn Coturn prior to 4.17.0

Timeline

2026-08-11: disclosed
2026-08-05: patched: Fixed in version 4.17.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.