# CVE-2026-73215: Coturn EVEN-PORT relay port exhaustion

Source: https://junglewise.ai/threats/cve-2026-73215-coturn-even-port-relay-port-exhaustion  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-11. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-73215 · Severity: info · CVSS 0 · Published 2026-08-11

Coturn is an open-source TURN/STUN server that enables voice, video, and data relay in peer-to-peer applications. A logic error in port allocation causes the server to permanently mark sibling ports as in-use even when not needed, allowing an authenticated client to exhaust the relay port pool and prevent new connections with a service error. This creates a denial-of-service condition where users cannot establish new relay sessions.

Technologies: [Coturn](https://junglewise.ai/threats/technologies/coturn). Vendors: [Coturn](https://junglewise.ai/threats/vendors/coturn).

## Quick answers

**Is CVE-2026-73215 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73215 being exploited in the wild.

**How severe is CVE-2026-73215?** Informational severity, with a CVSS score of 0, published 11 August 2026.

**Which products and versions are affected?** Coturn prior to 4.17.0.

**Is there a fix for CVE-2026-73215?** A patch was published on 2026-08-05: Fixed in version 4.17.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73215 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-73215?** Check whether you run Coturn at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a resource exhaustion flaw in the turnports_allocate_even() function in src/apps/relay/turn_ports.c. When an authenticated client requests an EVEN-PORT allocation with the reservation (R) bit clear (indicating no RTCP socket should be reserved), the server incorrectly marks the odd sibling port as TPS_TAKEN_ODD. Since no RTCP socket is bound to this sibling for R=0 requests, it is never released, permanently removing one port from the available pool. An attacker can repeatedly issue EVEN-PORT(R=0) Allocate requests to exhaust the relay port range, causing subsequent allocations to fail with STUN error 508. Authentication is required; the fix in version 4.17.0 returns the even port immediately when R=0, leaving the sibling available.

## Affected products

- Coturn Coturn prior to 4.17.0

## Timeline

- 2026-08-11: disclosed
- 2026-08-05: patched: Fixed in version 4.17.0

## References

- [https://github.com/coturn/coturn/commit/4adbd82e78456e13109bf44deed4ec3aceb0bab2](https://github.com/coturn/coturn/commit/4adbd82e78456e13109bf44deed4ec3aceb0bab2)
- [https://github.com/coturn/coturn/releases/tag/4.17.0](https://github.com/coturn/coturn/releases/tag/4.17.0)

## Related threats

- [Coturn quota bypass in mobility-enabled allocations](https://junglewise.ai/threats/cve-2026-73216-coturn-quota-bypass-in-mobility-enabled-allocations)
- [Coturn DTLS memory exhaustion via fragmented ClientHello](https://junglewise.ai/threats/cve-2026-73214-coturn-dtls-memory-exhaustion-via-fragmented-clienthello)
- [Coturn IPv6 range check bypass in TURN relay](https://junglewise.ai/threats/cve-2026-73213-coturn-ipv6-range-check-bypass-in-turn-relay)
- [Coturn TURN/STUN relay ACL bypass via IPv6 address encoding](https://junglewise.ai/threats/cve-2026-73212-coturn-turn-stun-relay-acl-bypass-via-ipv6-address-encoding)
- [Coturn authorization bypass in MICE mobility session resumption](https://junglewise.ai/threats/cve-2026-65981-coturn-authorization-bypass-in-mice-mobility-session-resumption)