Executive brief
Coturn is an open-source TURN/STUN server that enables voice, video, and data relay in peer-to-peer applications. A logic error in port allocation causes the server to permanently mark sibling ports as in-use even when not needed, allowing an authenticated client to exhaust the relay port pool and prevent new connections with a service error. This creates a denial-of-service condition where users cannot establish new relay sessions.
Technical details
The vulnerability is a resource exhaustion flaw in the turnports_allocate_even() function in src/apps/relay/turn_ports.c. When an authenticated client requests an EVEN-PORT allocation with the reservation (R) bit clear (indicating no RTCP socket should be reserved), the server incorrectly marks the odd sibling port as TPS_TAKEN_ODD. Since no RTCP socket is bound to this sibling for R=0 requests, it is never released, permanently removing one port from the available pool. An attacker can repeatedly issue EVEN-PORT(R=0) Allocate requests to exhaust the relay port range, causing subsequent allocations to fail with STUN error 508. Authentication is required; the fix in version 4.17.0 returns the even port immediately when R=0, leaving the sibling available.
Affected products
- Coturn Coturn prior to 4.17.0
Timeline
- 2026-08-11: disclosed
- 2026-08-05: patched: Fixed in version 4.17.0