Log in Start free

Vulnerability · Published Aug 11, 2026 · Assigned by GitHub_M

CVE-2026-73215The coturn server can end in a state where it does not accept more requests with "even-port" enabled.

High 7.1

In plain English

A high-severity uncontrolled resource consumption in coturn from coturn. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)7.1High
Exploit odds (30 days)0.5%top 60.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, turnports_allocate_even() in src/apps/relay/turn_ports.c marks the unused odd sibling port as TPS_TAKEN_ODD for an EVEN-PORT Allocate request with reservation bit R=0 even though no RTCP socket will release it, allowing an authenticated client to permanently exhaust the relay port pool and cause subsequent allocations to fail with STUN error 508. This issue is fixed in version 4.17.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12coturnno fix listedDEBIAN-CVE-2026-73215
Debian:13coturnno fix listedDEBIAN-CVE-2026-73215
Debian:14coturn4.18.0-1DEBIAN-CVE-2026-73215
Ubuntu:22.04:LTScoturnno fix listedUBUNTU-CVE-2026-73215
Ubuntu:24.04:LTScoturnno fix listedUBUNTU-CVE-2026-73215
Ubuntu:26.04:LTScoturnno fix listedUBUNTU-CVE-2026-73215
Ubuntu:26.10coturnno fix listedUBUNTU-CVE-2026-73215

Affected products (as reported)

VendorProductVersions
coturn coturn < 4.17.0

Weakness: CWE-400, CWE-772 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References