Log in Start free

Vulnerability · Published Aug 11, 2026 · Assigned by GitHub_M

CVE-2026-73214coturn allocates a full per-peer SSL/session before verifying the DTLS cookie, enabling source-spoofing/botnet state-exhaustion DoS

High 8.2

In plain English

A high-severity uncontrolled resource consumption in coturn from coturn. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.2High
Exploit odds (30 days)0.6%top 52.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, dtls_server_input_handler() and create_new_connected_udp_socket() in src/apps/relay/dtls_listener.c retain OpenSSL dtls1_reassemble_fragment() state for a 35-byte fragmented ClientHello declaring a 650,000-byte handshake before cookie validation, allowing an unauthenticated remote sender using fresh UDP tuples to exhaust memory without TURN credentials, a completed handshake, a valid cookie, or source spoofing. This issue is fixed in version 4.16.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12coturnno fix listedDEBIAN-CVE-2026-73214
Debian:13coturnno fix listedDEBIAN-CVE-2026-73214
Debian:14coturn4.18.0-1DEBIAN-CVE-2026-73214
Ubuntu:22.04:LTScoturnno fix listedUBUNTU-CVE-2026-73214
Ubuntu:24.04:LTScoturnno fix listedUBUNTU-CVE-2026-73214
Ubuntu:26.04:LTScoturnno fix listedUBUNTU-CVE-2026-73214
Ubuntu:26.10coturnno fix listedUBUNTU-CVE-2026-73214

Affected products (as reported)

VendorProductVersions
coturn coturn < 4.16.0

Weakness: CWE-400, CWE-770 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References