Log in Start free

Vulnerability · Published Aug 11, 2026 · Assigned by GitHub_M

CVE-2026-73213Coturn: `addr_less_eq()` does a component-wise IPv6 comparison instead of a lexicographic one, letting an authenticated TURN client bypass `denied-peer-ip`/`allowed-peer-ip` IPv6 ranges (TURN-specific SSRF)

Medium 5.8

In plain English

A medium-severity incorrect authorization in coturn from coturn. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)5.8Medium
Exploit odds (30 days)0.4%top 64.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, addr_less_eq() in src/client/ns_turn_ioaddr.c uses a component-wise comparison for native IPv6 min-max intervals in ioa_addr_in_range(), allowing an authenticated TURN client to relay to an IPv6 peer that is numerically within a configured non-prefix-aligned denied-peer-ip range but is classified as outside it. This issue is fixed in version 4.16.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12coturnno fix listedDEBIAN-CVE-2026-73213
Debian:13coturnno fix listedDEBIAN-CVE-2026-73213
Debian:14coturn4.18.0-1DEBIAN-CVE-2026-73213
Ubuntu:22.04:LTScoturnno fix listedUBUNTU-CVE-2026-73213
Ubuntu:24.04:LTScoturnno fix listedUBUNTU-CVE-2026-73213
Ubuntu:26.04:LTScoturnno fix listedUBUNTU-CVE-2026-73213
Ubuntu:26.10coturnno fix listedUBUNTU-CVE-2026-73213

Affected products (as reported)

VendorProductVersions
coturn coturn < 4.16.0

Weakness: CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H

References