CVE-2026-73214 in Coturn
Summary
by MITRE • 08/11/2026
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, dtls_server_input_handler() and create_new_connected_udp_socket() in src/apps/relay/dtls_listener.c retain OpenSSL dtls1_reassemble_fragment() state for a 35-byte fragmented ClientHello declaring a 650,000-byte handshake before cookie validation, allowing an unauthenticated remote sender using fresh UDP tuples to exhaust memory without TURN credentials, a completed handshake, a valid cookie, or source spoofing. This issue is fixed in version 4.16.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability exists within the coturn TURN and STUN server implementation affecting versions prior to 4.16.0. This represents a memory exhaustion attack that exploits the DTLS protocol handling within the server's relay functionality. The flaw specifically resides in the dtls_server_input_handler() and create_new_connected_udp_socket() functions located in src/apps/relay/dtls_listener.c. The issue demonstrates a critical design oversight in how the server manages DTLS handshake fragments, particularly when processing ClientHello messages that declare unusually large handshake sizes.
The technical exploitation involves sending a specially crafted UDP packet containing a 35-byte fragmented ClientHello message that falsely declares a 650,000-byte handshake payload. This malformed declaration triggers the OpenSSL dtls1_reassemble_fragment() function to retain internal state information for processing what appears to be an enormous DTLS handshake. The server maintains this state information even before completing cookie validation, which is a fundamental security check designed to prevent resource exhaustion attacks. This behavior allows attackers to consume server memory resources without providing valid TURN credentials, completing the DTLS handshake, or performing source address spoofing.
The operational impact of this vulnerability is significant as it enables denial-of-service conditions where remote unauthenticated attackers can exhaust system memory resources through simple UDP packet transmission. The attack requires no authentication, no existing connections, and no prior knowledge of valid session information. The vulnerability affects the server's ability to maintain legitimate service availability since an attacker can continuously send these malformed packets to consume memory resources until the server becomes unresponsive or crashes. This represents a classic resource exhaustion attack pattern that can be amplified through multiple UDP tuples to maximize memory consumption.
This vulnerability maps directly to CWE-400, which covers "Uncontrolled Resource Consumption" and specifically addresses memory exhaustion issues in protocol implementations. The attack vector aligns with ATT&CK technique T1499.004, "Endpoint Termination: Network Denial of Service," as it targets network service availability through resource consumption rather than direct system compromise. The flaw also demonstrates elements of CWE-122, "Heap-based Buffer Overflow," in the improper handling of memory allocation for reassembled DTLS fragments, though the specific manifestation is more about resource retention than buffer corruption.
The fix implemented in coturn version 4.16.0 addresses this issue by properly validating DTLS handshake fragment sizes before retaining state information. The implementation now enforces stricter bounds checking on ClientHello declarations and ensures that memory allocation for reassembled fragments occurs only after successful cookie validation. This prevents the retention of excessive state information for malformed packets while maintaining legitimate DTLS handshake processing capabilities. The mitigation strategy requires updating to version 4.16.0 or later, which includes proper rate limiting and fragment size validation mechanisms that prevent attackers from exploiting this memory exhaustion vector through UDP-based attacks.